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EXECUTIVE  SUMMARY 


Runway  incursions1  and  other  surface  incidents2  are  significant  threats  to  aviation  safety  and 
efficiency.  While  the  number  of  near  mid-air  collisions  has  remained  relatively  steady  since 
1995,  runway  incursions  have  steadily  increased.  It  is  no  surprise  that  “nearly  all  runway 
incursions  are  caused  by  human  error”  (FAA,  1998  Airport  Surface  Operations  Safety  Action 
Plan,  p.  1).  While  the  opportunities  for  equipment  malfunctions  to  cause  such  problems  are 
relatively  rare,  the  opportunities  for  human  error  are  abundant.  The  proximity  and  number  of 
aircraft  in  the  terminal  environment,  combined  with  the  complexity  of  operations  and  the 
requirement  for  split-second  timing,  conspire  to  make  the  airport  surface  and  proximal  airspace 
extremely  unforgiving  of  pilot  and  controller  errors. 

Several  studies  have  been  conducted  to  examine  the  causes  of  these  incidents  and  to  identify 
solutions  to  the  underlying  problems.  This  report  presents  a  review  of  the  literature  in  two  parts. 
The  first  is  an  examination  of  research  on  the  causes  of  human  errors  involved  in  operations  on 
the  airport  surface  and  other  critical  operations  under  the  control  of  air  traffic  control  towers 
(ATCT).  This  literature  is  reviewed  to  identify  “shortfalls”  in  the  tower  and  potential  remedies; 
this  report  does  not  attempt  to  address  training,  procedures,  work  schedules,  airport  markings, 
etc.  The  second  part  of  this  examines  previous  efforts  at  system  integration  in  the  tower  and  the 
criteria  that  were  used  in  these  efforts. 

The  second  half  of  this  document  describes  the  results  of  an  analysis  of  safety  data  —  operational 
errors  and  deviations,  reports  submitted  by  tower  controllers  and  pilots  on  surface  incidents  to 
the  Aviation  Safety  Reporting  System  (ASRS),  and  National  Transportation  Safety  Board 
(NTSB)  reports  of  accidents  and  incidents  —  in  light  of  the  conclusions  and  recommendations 
presented  in  the  reviewed  literature. 

The  results  of  the  analysis  of  safety  data  were  consistent  with  the  results  of  previous  work.  The 
most  common  factors  contributing  to  controller  errors  in  the  tower  were: 

•  Forgetting  about  an  aircraft,  the  closure  of  a  runway,  a  vehicle  on  the  runway,  and/or  a 
clearance  that  he/she  had  issued. 

•  Communication  errors  —  readback/hearback  errors,  issuing  wrong  instruction  or  issuing 
instruction  to  wrong  aircraft. 

•  Lack  of,  or  incomplete,  coordination  between  controllers. 


1  A  runway  incursion  is  defined  as  “any  occurrence  at  an  airport  involving  an  aircraft,  vehicle,  person,  or  object  on 
the  ground  that  creates  a  collision  hazard  or  results  in  loss  of  separation  with  an  aircraft  taking  off,  intending  to  take 
off,  landing  or  intending  to  land”  (FAA,  November,  1999,  p.  G-4). 

A  surface  incident  is  defined  as  “any  event  where  unauthorized  or  unapproved  movements  occurs  within  the 
movement  area  or  an  occurrence  in  the  movement  area  associated  with  the  operation  of  an  aircraft  that  affects  or 
could  affect  the  safety  of  flight”  (Ibid.,  p.  G-4). 
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An  additional  factor  identified  in  the  literature,  absence  of  a  supervisor  (who  was  not  working  a 
control  position),  is  supported  by  the  data,  but  warrants  further  study.  In  many  cases,  it  was  the 
supervisor  (or  controller-in-charge)  that  prevented  a  bad  situation  from  getting  much  worse. 

The  tower  “shortfalls”  that  this  study  points  to  are  the  need  to  prevent,  and  mitigate  the 
consequences  of,  errors  due  to:  failures  of  controller  memory,  miscommunications 
between  pilots  and  controllers,  failures  of  coordination  among  controllers,  failure  of 
controllers  to  accurately  project  separation  between  aircraft.  This  could  be  accomplished 
in  a  number  of  ways.  Some  of  which  include: 

•  Improved  surveillance  and  monitoring  equipment  (e.g.,  ASDE-X,  AMASS,  runway  status 
lights,  loops).  Peripherally  included  in  this  is  that  pilots  and/or  controllers  need  a  means 
of  determining  whether  an  aircraft  is  clear  of  the  runway. 

•  Better  memory  aids  for  controllers  (and  more  consistent  use  of  memory  aids). 

•  Improved  means  of  controller-pilot  communication  (to  reduce  frequency  congestion, 
eliminate  blocked  transmissions,  and  reduce  the  probability  of  an  aircraft  accepting  a 
clearance  intended  for  another  aircraft). 

•  Improved  means  to  facilitate  coordination  among  controllers  -  this  could  be 
accomplished  by  a  variety  of  means,  such  as  shared  displays,  improved  means  of  voice 
communication,  and  changes  in  procedure.  The  most  appropriate  means  needs  to  be 
determined  by  the  coordination  required. 

In  addition,  the  following  recommendations  resulted  from  the  analysis: 

•  Revise  the  method  for  investigating,  collecting  information,  and  recording  information  on 
controller  operational  errors  and  deviations  so  that  it  is  more  consistent  and  useful  in 
determining  the  causes  and  potential  remedies  to  incidents. 

•  Survey  towers  for  “homemade”  memory  aids,  runway  incursion  prevention  mechanisms, 
and  other  unique  facility  inventions  (such  as  a  bar  code  mechanism  to  record  delay  times) 
so  that  the  effects  of  these  aids  can  be  studied  and  the  information  can  be  disseminated  to 
all  towers. 

•  Provide  support  to  towers  to  expedite  the  acquisition  of  needed  equipment  or  other 
resources. 

•  Encourage  individual  towers  to  perform  their  own  “risk  analysis”  identifying  significant 
factors  in  their  own  incidents  (e.g.,  where  on  the  airport  surface  the  incidence  are  taking 
place,  the  type  of  aircraft  operators  involved  [helicopter,  GA,  military],  etc.),  and  identify 
what  can  be  done  (markings,  procedures,  pilot  education,  etc.)  to  prevent  future 
occurrences  and  provide  the  resources  to  assist  towers  in  these  analyses  and  remedies. 

•  Improve  airport  signage  and  markings,  particularly  the  conspicuity  of  “hold  short”  points. 
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1.  INTRODUCTION  AND  SCOPE 


Runway  incursions3  and  other  surface  incidents4  are  significant  threats  to  aviation  safety  and 
efficiency.  As  can  be  seen  in  Figure  1,  while  the  number  of  reported  near  mid-air  collisions  has 
remained  relatively  steady  since  1995,  the  number  of  reported  runway  incursions  has  steadily 
increased.  While  it  is  impossible  to  know  how  much  of  this  increase  might  be  due  to  an 
increased  awareness  of  the  problem  and  increased  willingness  to  report  incursions,  it  is  clear  that 
runway  incursions  require  intervention. 
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Figure  1.  Reported  Runway  Incursions  and  Pilot  Reported  Near  Mid-Air  Collisions 


It  is  no  surprise  that  “nearly  all  runway  incursions  are  caused  by  human  error”  (FAA,  1998 
Airport  Surface  Operations  Safety  Action  Plan,  p.  1).  While  the  opportunities  for  equipment 
malfunctions  to  cause  such  problems  are  relatively  rare,  the  opportunities  for  human  error  are 


3  A  runway  incursion  is  defined  as  “any  occurrence  at  an  airport  involving  an  aircraft,  vehicle,  person,  or  object  on 
the  ground  that  creates  a  collision  hazard  or  results  in  loss  of  separation  with  an  aircraft  taking  off,  intending  to  take 
off,  landing  or  intending  to  land”  (FAA,  November,  1999,  p.  G-4). 

A  surface  incident  is  defined  as  “any  event  where  unauthorized  or  unapproved  movements  occurs  within  the 
movement  area  or  an  occurrence  in  the  movement  area  associated  with  the  operation  of  an  aircraft  that  affects  or 
could  affect  the  safety  of  flight”  (Ibid.,  p.  G-4). 
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abundant.  The  proximity  and  number  of  aircraft  in  the  terminal  environment,  combined  with  the 
complexity  of  operations  and  the  requirement  for  split-second  timing,  conspire  to  make  the 
airport  surface  and  proximal  airspace  extremely  unforgiving  of  pilot  and  controller  errors. 

The  purposes  of  this  paper  were  to  provide  a  comprehensive  review  of  relevant  literature  and  to 
analyze  current  safety  data;  this  information  was  used  to  identify  “shortfalls”  in  the  FAA  air 
traffic  control  towers  (ATCT)  and  potential  remedies  for  these  shortfalls.  Several  studies  have 
been  conducted  to  examine  the  causes  of  these  incidents  and  to  identify  solutions  to  the 
underlying  problems.  This  literature  was  reviewed  in  two  parts.  The  first  is  an  examination  of 
research  on  the  causes  of  human  errors  involved  in  operations  on  the  airport  surface  and  other 
critical  operations  under  the  control  of  ATCTs.  The  scope  of  this  report  excluded:  training, 
procedures,  work  schedules,  airport  markings,  etc;  in  short,  it  was  not  intended  to  address 
anything  outside  of  the  tower.  The  second  part  of  this  review  looks  specifically  at  work  done  on 
systems  integration  in  the  tower.  As  new  systems  are  implemented  in  the  tower  to  provide  more 
useful  information  to  controllers,  the  need  for  integration  increases  with  the  amount  and 
complexity  of  the  new  information.  Yet,  the  questions  about  specifically  which  displays  should 
be  integrated,  and  how  they  should  be  integrated,  remain  unanswered.  This  part  of  the  literature 
review  examined  previous  efforts  at  system  integration  in  the  tower  and  the  criteria  that  were 
used  in  these  efforts. 

The  second  half  of  this  document  describes  the  results  of  an  analysis  of  safety  data  -  operational 
errors  and  deviations,  reports  submitted  by  tower  controllers  and  pilots  on  surface  incidents  to 
the  Aviation  Safety  Reporting  System  (ASRS),  and  National  Transportation  Safety  Board 
(NTSB)  reports  of  accidents  and  incidents  -  in  light  of  the  conclusions  and  recommendations 
presented  in  the  reviewed  literature. 
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2.  RESEARCH  ON  SURFACE  INCIDENTS 


Several  studies  have  examined  the  causes  of  runway  incursions  and  other  surface  incidents  and 
sought  to  identify  solutions  to  the  underlying  problems.  These  studies  will  be  examined  in 
chronological  order. 

2.1  THE  FIRST  STUDY  OF  RUNWAY  INCURSIONS 

The  first  comprehensive  study  of  runway  incursions  was  begun  in  1978  when  the  number  of 
reported  number  of  accidents  and  incidents  on  the  airport  surface  in  the  past  ten  years  was  only 
279.  Bellatoni  and  Kodis  (1981)  examined  161  ASRS  reports,  77  NTSB  accidents,  and  49  ATC 
system  errors  and  interviewed  tower  personnel  from  the  New  England,  Great  Lakes,  and  Western 
Regions  (each  of  these  regions  had  conducted  their  own,  unpublished,  studies  of  runway 
incursions).  Interviews  with  tower  personnel  revealed  that  runway  and  taxiway  transgressions 
were  much  more  frequent  than  formal  reporting  systems  indicated,  in  part,  due  to  the  time  and 
effort  involved  in  the  reporting  process.  The  ASRS  and  NTSB  reports  examined  contained  166 
“runway  transgressions,”  this  included  runway  incursions  and  other  surface  incidents.  Five 
percent  of  these  transgressions  were  attributable  to  “airport,  equipment,  and  other”  and  95 
percent  were  attributable  to  human  error  (p.  71).  Of  the  latter,  roughly  50  percent  were 
attributable  to  pilot  errors  and  50  percent  were  attributable  to  controller  errors.  The  most 
prominent  types  of  errors  in  runway  transgressions  were  pilots  proceeding  without  a  clearance 
and  controllers  issuing  conflicting  clearances.  While  such  statistics  are  easy  to  understand,  they 
do  little  more  than  satisfy  our  apparent  need  to  identify  the  party  “at  fault.”  In  order  to  be  able  to 
take  corrective  action  to  prevent  such  errors,  the  nature  of  the  errors  and  the  factors  associated 
with  the  errors  must  be  understood.  The  report  concluded  with  a  recommendation  for  the 
construction  of  a  more  detailed  data  base  from  which  a  more  fruitful  study  of  the  causes  of 
runway  incursions  could  be  based. 

2.2  NTSB  SPECIAL  INVESTIGATION 

In  1986,  the  National  Transportation  Safety  Board  issued  a  Special  Investigation  Report 
(NTSB/SIR-86/01)  after  investigating  26  runway  incursions.  The  purpose  of  this  investigation 
was  to  “investigate  selected  runway  incursions  to  determine  their  underlying  causes  and  to 
recommend  appropriate  remedial  actions”  (p.  1).  For  the  purposes  of  the  study,  “runway 
incursion”  was  defined  as  “any  occurrence  involving  an  aircraft,  vehicle,  person,  object  or 
procedure  that  impedes  the  takeoff,  intended  takeoff,  landing  or  intended  landing  of  an  aircraft” 
(p.  1).  The  FAA  had  identified  65  percent  of  these  incursions  as  attributable  to  controller  error 
and  35  percent  to  pilot  error.  However,  the  Safety  Board  acknowledged  that  in  many  of  the 
incursions,  both  pilot  and  controller  behaviors  were  involved  and  that  “many  of  the  incursions 
classified  as  operational  errors  could  have  been  prevented  by  proper  action  by  the  pilots 
involved”  (p.  34). 

Most  (65  percent)  of  the  incursions  that  had  been  attributed  to  controller  errors  resulted  from  the 
actions  of  individual  controllers  and  35  percent  of  these  errors  resulted  from  “incomplete  or 
misunderstood  coordination  between  two  controllers.”  The  largest  single  category  of  controller 
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errors  (identified  in  44  percent  of  the  incursions  attributed  to  controller  error)  was  that  controllers 
“had  forgotten  about  an  aircraft  or  about  previously  effected  coordination  with  the  other 
controllers”  (p.  2).  In  terms  of  causal  factors,  the  “primary  controller-related  factors  identified  in 
the  runway  incursion  special  investigation  were  forgetting  aircraft  and  lack  of  or  incomplete 
coordination  between  controllers”  (p.  15).  Forty-four  percent  of  the  incursions  that  the  FAA  had 
attributed  to  controller  error  involved  the  controller  forgetting  something  significant,  e.g.,  the 
presence  of  aircraft  on  a  runway,  the  closure  of  a  runway,  or  a  clearance  that  he/she  had  issued. 

The  experience  level  of  the  controllers  involved  was  not  identified  as  a  causal  factor;  controllers 
of  all  experience  levels  were  involved  in  the  incursions  studied.  However,  the  controllers  with 
the  most  experience  were  acting  in  a  supervisory  (supervisor  or  controller-in-charge)  role  at  the 
time  of  the  incident  and  were  usually  working  control  positions  simultaneously.  “In  almost  all  of 
the  runway  incursions  classified  as  operational  errors,  the  supervisor  either  was  not  in  the  tower 
cab  or  was  working  at  least  one  control  position”  (p.  35).  The  report  also  states  which  “A  lack  of 
controller  and/or  supervisory  redundancy  in  the  tower  cab  is  a  factor  common  to  many 
controller-induced  runway  incursions”  (p.  35).  This  points  to  the  need  for  increased  redundancy 
in  the  tower.  Clearly  an  “extra  set  of  eyes”  can  go  a  long  way  toward  providing  the  necessary 
oversight  to  prevent  operational  errors  in  the  tower. 

Lack  of,  or  incomplete,  coordination  between  local  and  ground  controllers  was  a  significant 
factor  in  66  percent  of  the  incidents  attributed  to  controller  error.  “Several  of  the  runway 
incursions  classified  as  operational  error  could  have  been  prevented  if  there  had  been  more 
complete  communication  and  coordination  between  the  ground  and  local  controllers”  (p.  35). 

No  other  factors,  were  determined  to  be  significant  causal  factors,  in  fact,  “most  incidents 
occurred  in  low  traffic  and  under  conditions  of  excellent  visibility”  (p.  34).  It  should  be  noted, 
however,  that  this  does  not  mean  that  complex  traffic  situations  or  visibility  are  not  important 
factors  in  determining  the  probability  of  an  incident  or  accident.  To  determine  this,  one  would 
need  to  know  the  incident  rate  for  the  various  conditions  (poor  visibility,  complex  traffic,  etc.). 
This  would  require,  for  example,  comparing  the  number  of  incidents  in  poor  visibility  as  a 
function  of  the  number  of  operations  in  poor  visibility  to  the  number  of  incidents  that  occur  in 
good  visibility  as  a  function  of  the  number  of  operations  in  good  visibility.  Such  analysis  was 
not  found  in  the  literature. 

Of  the  35  percent  of  the  incursions  classified  by  the  FAA  as  due  to  pilot  error,  all  of  them  were 
attributable  to  a  pilot  entering,  crossing,  or  taking  off  from  a  runway  without  a  clearance.  In 
“several”  of  these  instances,  runway  and  taxiway  signs  were  “missing  or  inadequate.”  In  “at 
least  two  [of  the  nine]  instances,  pilots  did  not  comply  with  controller  clearances  which  the  pilots 
had  acknowledged  receiving”  (p.  2).  These  runway  incursions  “usually  involved  either 
communication  problems,  such  as  misunderstanding  clearances,  or  inadvertent  entry  of  a  runway 
because  of  disorientation”  (p.  12). 

As  a  result  of  this  special  investigation,  the  NTSB  submitted  several  recommendations  to  the 
FAA.  To  address  the  problems  associated  with  controller  memory  failure,  there  was  a 
recommendation  to  “Establish  an  ad  hoc  task  force,  including  controller  and  human  performance 
expertise,  to  develop  effective  memory  aids  that  would  reduce  incidents  of  air  traffic  controllers 
forgetting  traffic,  and  to  incorporate  a  description  of  these  memory  aids  and  how  they  should  be 
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used  in  . . .controller  training. . .”  (A-86-32).  This  recommendation  was  classified  as  “closed  - 
acceptable  action”  with  the  publication  of  the  FAA  pamphlet  “Controller’s  Memory  Manual  -  A 
Self-Help  Guide.” 

The  only  NTSB  recommendation  contained  in  this  report  that  identifies  equipment  needed  in  the 
tower  speaks  to  the  problem  of  controllers  forgetting  about  vehicles  on  an  active  runway.  This 
recommendation  is  to  “Develop  a  mechanical/aural/visual  (or  combination  thereof)  alert  device 
and  require  its  use  by  local  and  ground  controllers  to  coordinate  their  activities  when  a  vehicle 
has  been  cleared  to  operate  on  the  active  duty  runway  for  an  extended  period  such  as  in  snow 
removal  operations”  (A-85-15). 

While  memory  aids  are  useful,  we  must  recognize  the  fact  that  human  memory  is  a  fallible 
system.  Memory  will  fail  at  times,  no  matter  how  experienced,  well-trained,  motivated,  or 
conscientious  an  individual  is;  it  is  this  fallibility  that  well-designed  automated  tools  can  and 
should  be  implemented  to  offset. 

Finally,  there  is  the  recommendation  to  “Revise  the  current  tower  training  curriculum  at  the  ATC 
Academy  to  include  more  emphasis  on  practical  standardized  “hand-on”  tower  training  dynamic 
laboratory  and  simulation  facilities  (A-86-30).  While  a  tower  simulator  would  be  of  obvious  use 
in  training,  much  of  the  training  of  tower  controllers  is  necessarily  “on-the-job”  due  to  airport 
specific  operations.  Furthermore,  since  it  is  impossible  to  train  human  error  out  of  a  system,  it  is 
also  necessary  to  invest  in  tools  and  other  mechanisms  that  controllers  can  use  to  alert  them  to 
their  own  oversights  and  pilot  errors. 

2.3  MITRE’S  ANALYSES  OF  RUNWAY  INCURSIONS  DUE  TO  ATC 
OPERATIONAL  ERRORS 

The  MITRE  Corporation  has  conducted  two  analyses  of  runway  incursions  that  resulted  from 
operational  errors.  The  first  study  (Bales,  Gilligan,  and  King,  1989)  examined  all  runway 
incursions  in  1985  and  1986  that  resulted  from  an  operational  error  and  either  occurred  at  a 
major  airport  or  involved  a  commercial  air  carrier.  The  second  study  (Steinbacher,  1991) 
examined  109  runway  incursions  that  occurred  between  January  1987  and  October  1989  due  to 
operational  errors.  Since  the  results  of  the  two  studies  were  nearly  identical,  they  will  be 
examined  together.  Most  of  the  incidents  occurred  in  daylight  and  good  weather.  Weather  was 
considered  to  be  a  factor  in  5  percent  of  the  incidents  in  the  1989  study;  in  the  1991  study,  “no 
report  explicitly  identified  weather  as  a  factor.”  With  respect  to  controller  workload, 
“complexity”  was  listed  as  less  than  average  at  the  time  of  the  incident  in  35  percent  of  the 
incursions,  as  average  in  29  percent  of  the  cases  and  above  average  in  36  percent  of  the  reports. 
The  significant  causal  factors  found  in  both  of  these  studies  were  attributed  to  the  controller’s: 

•  “Failure  to  verify  the  location  of  the  aircraft  or  vehicle”  (identified  in  37  percent  of  the 
incidents  in  the  1991  study). 

•  Forgetting  about  an  aircraft,  an  instruction,  the  traffic  or  runway  situation  (34  percent). 
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•  Failure  to  anticipate  the  required  separation  or  miscalculation  of  the  impeding  separation 
(19  percent). 

•  Failure  to  coordinate  with  another  controller  (13  percent). 

•  Communication  errors  -  readback/hearback  errors,  issuing  wrong  instruction  or  issuing 
instruction  to  wrong  aircraft  (11  percent). 

•  Supervisor  working  a  position  or  engaged  in  activities  other  than  directly  supervising 
staff  (9  percent). 

The  solutions  to  these  incidents  that  were  proffered  by  both  reports  were: 

•  Installation  of  ASDE-3  and  AMASS  (Airport  Movement  Area  Safety  System). 

•  Electronic  flight  strips. 

•  Development  of  a  voice  recognition  system  to  monitor  key  words  in  transmissions  and 
compare  responses  to  detect  errors. 

•  Development  of  a  tool  that  will  help  controllers  to  ensure  separation  and  will  alert 
controllers  to  a  potential  loss  in  separation. 

2.4  ANALYSIS  OF  SURFACE  INCIDENTS  AT  12  AIRPORTS  BY  ALARIS,  CO. 

INC.  (1992) 

This  study  analyzed  235  “surface  incidents”  that  occurred  at  the  12  selected  airports  (Atlanta, 
Boston,  Cincinatti,  Denver,  Dallas/Ft.Worth,  New  York  -  JFK,  Los  Angeles,  Chicago  O’Hare, 
Pittsburgh,  Phoenix,  San  Antonio,  and  Seattle)  between  1988-1990.  Fifty-five  percent  of  these 
incidents  were  pilot  deviations,  26  percent  were  operational  errors/deviations,  17  percent  were 
vehicle/pedestrian  deviations  and  2  percent  were  incident  reports  from  NTSB  files.  Half  of  the 
235  surface  incidents  were  classified  as  runway  incursions.  Of  these,  49  percent  were  attributed 
to  controller  operational  errors,  32  percent  were  pilot  deviations,  and  19  percent  were  vehicle/ 
pedestrian  deviations.  Unfortunately,  the  usefulness  of  this  report  is  limited  for  two  reasons. 
First,  since  the  purpose  of  this  study  was  to  look  for  patterns  in  these  incidents  at  the  individual 
airports,  the  results  were  not  consolidated  to  identify  overall  patterns.  Second,  the  analysis  of  the 
human  errors  (i.e.,  pilot  deviations  and  operational  errors/deviations)  consisted  solely  of  a 
classification  of  the  type  of  error  (e.g.,  pilot  crossed  an  active  runway  rather  than  holding  short  as 
instructed);  it  did  not  attempt  to  identify  the  factors  that  contributed  to  the  errors  or  information 
or  tools  that  could  have  prevented  the  errors. 

2.5  MITRE’S  PILOT  SURFACE  INCIDENT  SAFETY  STUDY  (1993) 

Kelly  and  Steinbacher  (1993)  analyzed  75  reports  submitted  by  pilots  to  the  Aviation  Safety 
Reporting  System  (ASRS)  and  their  subsequent  “structured  call  backs”  (post-report  telephone 
interviews).  Although  the  study  was  cockpit-oriented  and  focused  on  factors  that  affect  pilot 
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performance,  it  does  contain  one  recommendation  that  points  to  a  tower  “shortfall.”  The  analysis 
showed  that  “radio  frequency  congestion  contributed  to  numerous  incidents”  (p.  4-3)  and 
resulted  in  blocked  transmissions,  incomplete  messages,  repeated  communications,  and 
misunderstood  instructions.  The  report  recommended  that  the  FAA  “develop  means  other  than 
radio  voice  communications  for  exchanging  information  between  pilots  and  controllers”  (p.  xii). 
This  was  deemed  a  necessity  because  “at  many  major  airports  and  other  facilities  with  high 
traffic  volume,  radio  communication  is  approaching  its  limits  of  effectiveness  as  a  mode  for 
transferring  information  between  pilots  and  controllers”  (p.  4-4).  This  finding  was  strongly 
confirmed  by  controller  and  pilot  opinion  in  extensive  surveys  of  tower  controllers  (Kelly  and 
Jacobs,  1998)  and  airline  pilots  on  airport  surface  operations  (Adam,  Kelly,  and  Steinbacher, 
1994;  Adam  and  Kelly,  1996).  These  later  reports  also  speak  to  the  same  “shortfall”  in 
controller-pilot  communications  as  mentioned  in  the  study  of  ASRS  reports: 

“The  survey  findings  show  this  interface  to  be  one  of  the  weakest  parts  of  the 
airport  surface  system.  Surface  operations  have  changed  markedly  in  the  recent 
years  as  ATC  has  accommodated  more  and  more  traffic.  The  voice 
communication  that  worked  effectively  with  less  traffic  is  now  strained  to  the 
breaking  point  during  peak  traffic  periods.  At  these  times,  the  controllers  cannot 
communicate  with  the  pilots  in  the  way  ATC-pilot  communication  was  designed 
to  work.  The  original  design  intentionally  included  safety  measures  such  as 
proper  timing  and  readbacks,  which  are  now  being  dropped  so  that  more  ATC 
instructions  can  be  crowded  onto  the  frequencies  at  busy  times.  Yet  these  are  the 
very  times  when  the  consequences  of  errors  may  be  more  critical,  and  safety 
measures  are  needed  the  most.  The  complexity  of  some  current  operation  means 
that  any  breakdown  of  the  ATC-pilot  interface  can  be  critical  to  safety.  The 
potential  for  such  breakdown  is  now  greater  than  ever”  (p.  7-10). 

2.6  STUDIES  OF  TOWER  CONTROLLER-PILOT  VOICE  COMMUNICATIONS 

It  should  be  noted  that  the  above  findings  and  recommendations  were  based  on  controller  and 
pilot  opinion  and  ASRS  reports  -  not  data  based  on  frequency  of  occurrence  (i.e.,  incidence 
data).  However,  incidence  data  from  studies  of  tower-pilot  voice  communications  also  support 
these  conclusions.  While  controller-pilot  communications  are  surprisingly  accurate  (with  only 
one  percent  of  the  controller  transmissions  resulting  in  readback  errors),  the  opportunities  for 
problems  are  numerous  due,  in  part,  to  the  sheer  number  of  communications.  Radio  frequencies 
in  the  terminal  environment  are  far  more  congested  than  those  in  the  en  route  environment. 

While  en  route  controllers  averaged  less  than  two  controller-to-pilot  communications  per  minute 
(Cardosi,  1993)  ground  controllers  averaged  eight  controller-pilot  communications  per  minute 
(Burki-Cohen,  1995).  The  average  for  local  controllers  was  three  (Cardosi,  1994)  and  TRACON 
was  4.5  per  minute  (Cardosi,  Brett,  and  Han,  1996).  These  numbers  are  now  seven  years  old  and 
so  represent  conservative  estimates  of  today’s  communication  activity.  Perhaps  because  of  the 
frequency  congestion,  27  percent  of  the  local  controllers’  transmissions  and  33  percent  of  the 
ground  controllers’  transmissions  were  responded  to  by  pilots  with  only  an  acknowledgement 
(e.g.,  “roger”);  an  additional  7  percent  of  the  local  control  transmissions  were  responded  to  with 
only  a  mike  click.  Twenty-eight  percent  of  the  controllers’  messages  on  the  local  control 
frequencies  and  32  percent  on  ground  control  were  responded  to  with  a  full  readback.  This  is 
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dramatically  lower  than  the  71  percent  of  the  controllers’  transmissions  en  route  and  60  percent 
of  the  TRACON  controllers’  transmissions  that  were  fully  readback.  This  same  series  of  studies 
also  revealed  that  the  factor  most  consistent  with  miscommunications,  i.e.,  readback  errors  and 
pilot  requests  for  repeats,  is  similar  call  signs  on  the  same  frequency.  This  was  a  coincident 
factor  in  12  percent  of  the  miscommunications  on  the  local  control  (tower)  frequencies,  6  percent 
in  the  TRACON  environment,  and  4  percent  of  the  miscommunications  in  the  en  route 
environment..  These  incident  data  point  to  the  same  types  of  problems  identified  by  pilots  in  the 
MITRE  survey  of  pilots  and  to  the  MITRE  identified  “urgent  need  to  both  improve  the  current 
voice  communication  system  and  find  other  reliable  and  timely  means  for  exchanging 
information  critical  to  the  safe  and  efficient  flow  of  surface  traffic”  (p.  7-1 1). 

2.7  SURVEY  OF  TOWER  CONTROLLERS  ON  AIRPORT  SURFACE 
OPERATIONS:  THE  CAUSES  AND  PREVENTION  OF  RUNWAY 
INCURSIONS 

Kelly  and  Jacobs  (1998)  conducted  an  extensive  survey  of  1 1 1 1  controllers  and  managers  at  63 
Level  3, 4  and  5  towers  and  asked  for  their  opinions  on  a  variety  of  different  topics5.  The  results 
identified  five  areas  for  consideration  of  tower  improvements: 

•  Stop  lights  on  runways  activated  by  surface  surveillance  systems. 

•  Improvements  to  ASDE-3: 

-  Tag  the  targets  with  the  aircraft  ID. 

-  Reduce  the  number  of  false  targets. 

-  Reduce  the  interference  caused  by  rain. 

•  Relief  from  radio  frequency  congestion. 

•  Relief  from  tower  cab  features  that  interfere  with  the  controllers’  scan  of  the  airport 
surface. 

-  Placement  of  displays  on  top  of  the  consoles  obstructs  vision. 

-  Inadequate  tower  shades  hinder  controllers’  ability  to  see  the  airport  surface. 

•  Improving  the  use  of  “memory  aids.” 

2.7.1  Stop  Lights  on  Runways 

Controllers  were  asked  the  extent  to  which  stop  lights  that  were  automatically  activated  by 
surface  surveillance  systems  would  reduce  the  risk  of  surface  incidents.  Twenty-one  percent  of 
the  respondents  had  no  opinion  (perhaps  they  were  wisely  waiting  for  data).  Of  those  who 
expressed  an  opinion,  only  1 1  percent  thought  that  they  would  have  no  effect.  Thirty  percent 
thought  that  they  would  have  a  significant  effect  on  reducing  surface  incidents,  with  the 
remainder  anticipating  that  they  would  have  a  moderate  (27  percent)  or  slight  (3 1  percent)  effect. 


5Two  thousand  four  hundred  and  nine  questionnaires  were  distributed,  1111  were  completed  and  returned. 
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Controllers  were  much  less  enthusiastic  about  the  suggestion  of  stop  lights  operated  by 
controllers,  largely  due  to  the  concern  for  increased  controller  workload. 

2.7.2  Improvements  to  ASDE-3 

Most  of  the  controllers  at  towers  that  had  ASDE-3  said  it  was  useful  in  controlling  surface 
traffic.  Seventy  percent  of  the  controllers  at  Level  5  towers  with  ASDE-3  rated  its  usefulness  as 
“significant”  and  said  it  was  “very  reliable.”  Note  that  this  is  not  actually  a  measure  of  the 
reliability  of  ASDE-3,  but  rather  it  is  a  measure  of  its  perceived  reliability  (which  is  directly 
related  to  the  controllers’  tendency  to  trust  and  use  it).  Eighty-five  percent  of  these  controllers 
thought  it  would  be  useful  to  add  aircraft  identification  information  displayed  on  ASDE-3  (i.e., 
tagged  targets)  and  63  percent  of  them  thought  that  it  would  be  useful  to  add  conflict  detection 
capability  to  ASDE-3.  The  report  recommended  that  the  FAA  pursue  these  improvements  to 
ASDE-3  and  determine  the  suitability  of  “low-cost  ASDE-like  radar  systems  (such  as  ASDE-X) 
for  airports  that  are  not  scheduled  to  receive  ASDE-3.” 

2.7.3  Frequency  Congestion 

The  results  of  the  controllers’  survey  echoed  those  of  the  pilots’  survey  on  the  subject  of 
frequency  congestion.  Thirteen  percent  of  the  controllers  surveyed  and  19  percent  of  the 
controllers  from  Level  5  towers  said  that  frequency  congestion  was  a  “significant”  risk  factor  for 
surface  incidents.  An  additional  37  percent  said  that  it  was  a  “moderate”  risk  factor.  Only  four 
percent  said  that  it  was  not  a  factor.  Nineteen  percent  of  the  respondents  and  29  percent  of  the 
controllers  from  Level  5  towers  said  that  an  “inability  to  access  the  frequency  when  needed”  was 
experienced  “often”  and  an  additional  40  percent  (44  percent  of  Level  5)  said  that  this  was 
“sometimes”  experienced.  Only  25  percent  of  the  Level  5  tower  controllers  said  that  an  inability 
to  access  the  frequency  when  needed  rarely  occurred. 

Interestingly,  when  controllers  were  asked  to  describe  pilot  phraseology  that  is  associated  with  a 
risk  of  surface  incidents,  they  cited  “abbreviated  or  incomplete  readbacks,”  and  “using 
microphone  clicks  as  a  substitute  for  verbal  readbacks.”  In  fact,  71  percent  of  the  comments 
offered  were  critical  of  incomplete  readbacks.  [This  figure  was  derived  from  the  raw  data  in  the 
appendices  and  is  not  contained  in  the  actual  report.]  Analysis  of  ATC  tapes  revealed  that,  on 
local  control  frequencies,  seven  percent  of  the  controllers’  transmissions  were  responded  to  with 
only  a  mike  click  (Cardosi,  1994).  While  this  lets  the  controller  know  that  “somebody  got 
something,”  it  does  not  afford  any  opportunity  to  catch  a  communication  error.  It  is  certainly  the 
case  that  full  readbacks  are  the  safest  pilot  response  as  they  at  least  provide  the  opportunity  for  a 
communication  error  to  be  caught  before  it  results  in  a  surface  incident.  However,  studies  of 
controller-pilot  voice  communications  have  shown  that  only  28  percent  of  the  local  controllers’ 
transmissions,  and  33  percent  of  the  ground  controllers’  transmissions,  result  in  a  full  readback 
(Cardosi,  1994;  Burki-Cohen,  1995).  If  pilots  tried  to  respond  to  each  transmission  with  a 
complete  readback,  the  resulting  increase  in  frequency  congestion  would  be  intolerable  at  busy 
facilities  (p.  7-32). 

Twenty-six  percent  of  the  respondents  and  32  percent  of  the  controllers  from  Level  5  towers  said 
that  there  was  a  “significant”  risk  of  surface  incidents  associated  with  a  stuck  mike.  An 
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additional  38  percent  of  the  controllers  said  that  there  was  a  “moderate”  risk  associated  with  a 
stuck  mike.  Roughly  half  of  the  respondents  and  62  percent  of  the  controllers  from  Level  5 
facilities  said  that  transmissions  were  “stepped-on”  “often.”  Forty  percent  of  the  respondents 
and  56  percent  of  the  controllers  from  Level  5  facilities  said  that  “blocked  readbacks”  were 
experienced  “often.”  The  report  recommended  that  the  FAA  implement  the  use  of  anti-stuck 
microphone  and  antiblocking  radio  technology  for  all  ATC  ground  radios  and  the  radios  of  all 
aircraft  operating  in  the  ATC  system  (p.  7-30). 

It  should  be  noted  that  while  these  controller  opinions  are  not  a  substitute  for  incidence  data  (i.e., 
how  often  something  happens),  they  provide  a  subjective  assessment  of  the  severity  of  the 
problem.  For  the  few  cases  in  which  we  do  have  incidence  data,  we  see  that  controllers  tend  to 
overestimate  their  occurrence.  For  example,  16  percent  of  the  controllers  believed  that  readback 
errors  occurred  “often”  and  55  percent  said  that  they  occur  “sometimes.”  Only  28  percent  were 
“correct”  in  saying  that  they  occur  “rarely,”  since  studies  have  shown  that  less  than  1  percent  of 
controller  transmissions  result  in  a  readback  error  (Cardosi,  1994;  Burki-Cohen,  1995).  This 
does  not  detract  from  the  potential  severity  of  the  consequences  of  a  single  readback  or  hearback 
error. 


2.7.4  Tower  Cab  Features  that  Interfere  with  the  Controllers’  Scan  of  the  Airport 
Surface 

Controllers  were  asked  about  features  of  the  tower  cab  that  interfere  with  the  visual  scan  of  the 
airport.  Two  hundred  forty-two  controllers  answered  this  open-ended  question  with  some 
controllers  listing  more  than  one  factor  in  their  response.  The  report  gave  no  analysis  of  these 
responses,  only  examples  of  them.  The  following  information  was  derived  from  reanalyzing  the 
original  data  contained  in  the  appendices.  Some  of  the  responses  were  outside  the  scope  of  the 
question  and  pertained  to  either  obstructions  outside  of  the  tower  cab,  or  the  position  or  height  of 
the  tower.  Of  the  pertinent  responses,  there  were  three  distinct  categories:  tower  structures, 
placement  of  tower  equipment  and  monitors,  and  problems  with  the  windows/shades.  Thirty- 
seven  percent  of  the  respondents  mentioned  non-movable  (or  not  easily  movable)  tower 
structures  such  as  support  beams,  consoles,  window  frames,  etc.,  as  obstructions  to  their  view  of 
the  airport  surface.  Thirty  percent  mentioned  movable  equipment  and  displays,  most  notably 
monitors  placed  on  top  of  the  consoles.  Interestingly,  1 1  percent  of  the  respondents  mentioned 
problems  with  the  windows  and/or  shades.  Most  of  the  responses  in  this  category  referred  to 
shades  that  did  not  work,  did  not  cover  enough  of  the  window,  or  were  inadequate  in  some  other 
way;  a  few  referred  to  dirty  windows. 

“Roll  up/pull  down  see  though”  shades  ...  are  a  hassle  to  operate,  provide 
two  additional  surfaces  to  collect  fingerprints,  dust  and  grime,  and  once 
they’ve  been  rolled  up  and  down  a  few  dozen  times  they  become  creased 
and  display  semi-opaque  wear  spots.  The  sensation  of  working  with  full 
blinds  is  about  as  comfortable  as  working  with  the  windows  covered  with 
budget  trash  can  liners...”  (p.  C-217-218). 

“Constant  problems  with  window  shades  interfere  with  controller’s  ability 
to  pay  attention  to  traffic  (won’t  latch,  fly  up  unexpectedly,  etc.)”  (p.  C- 
215). 
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While  we  don’t  normally  think  of  inadequate  window  shades  as  an  “obstruction”  to  the 
controllers’  view  of  critical  information,  the  fact  that  so  many  of  the  respondents  volunteered  it 
as  an  answer  to  this  question  clearly  suggests  that  controllers  consider  this  to  be  a  problem.  New 
technologies  that  could  become  effective  replacements  for  tower  shades  continue  to  develop.  At 
the  present,  they  would  probably  only  be  considered  (because  of  the  cost)  in  new  towers  that  are 
being  built.  (See  Appendix  B  for  a  full  discussion  of  this  issue.) 

2.7.5  Memory  Aids 

An  area  identified  in  the  report  that  is  peripherally  related  to  needed  tower  improvements  is  the 
controllers’  reliance  on  memory  for  important  information.  We  have  already  seen  that  the 
controller  forgetting  critical  information  has  been  a  cause  of  many  surface  incidents.  Yet,  many 
controllers  are  relying  on  their  (fallible)  memory  as  their  only  tools  for  remembering  that  aircraft 
have  been  cleared  to  land,  cleared  to  take  off,  or  cleared  to  position  and  hold.  When  asked  which 
memory  aids  they  use  to  remember  that  an  aircraft  had  been  cleared  for  take  off,  the  most 
common  response  was  “depend  mostly  on  my  memory.”  This  was  the  second  most  common 
response  when  asked  how  they  remember  that  an  aircraft  had  been  cleared  to  land  and  cleared  to 
position  and  hold.  The  most  common  method  cited  by  controllers  for  helping  them  to  remember 
that  an  aircraft  had  been  cleared  to  land  was  to  write  the  information  down  on  a  sheet  of  paper. 
The  most  common  cue  for  an  aircraft  cleared  to  position  and  hold  was  to  offest  (“cock”)  the 
flight  strip.  In  summary,  the  memory  aids  used,  if  any  varied  from  facility  to  facility  and  from 
controller  to  controller.  The  recommendation  contained  in  the  report  is  for  the  FAA  to  develop 
and  standardize  memory  aids  (such  as  specific  uses  of  flight  strips,  placards,  runway  intrusion 
lights.)  for  tower  controllers  to  be  used  for  control  functions  such  as  taxi  into  position  and  hold, 
intersection  takeoffs  cleared  to  land,  cleared  to  takeoff,  and  closed  runways  (p.  7-36). 

2.8  STUDIES  OF  CONTROLLER  ACTIVITIES  IN  THE  TOWER 

There  have  been  two  major  studies  sponsored  by  the  FAA  on  ATC  tower  activities.  The  first 
(Schmeidler  and  D’Avanzo,  1994)  was  conducted  to  support  the  development  of  staffing 
standards  for  tower  cabs.  The  activities  of  tower  controllers  were  observed,  logged,  and 
classified  into  “work  elements”  such  as  “look  out  of  cab,”  “look  at  BRTIE,”  “look  inside  cab.” 
Radio  transmissions  were  analyzed  for  number  (count),  duration,  and  content  (e.g.,  clearance, 
pushback,  position  and  hold).  Traffic  complexity  was  acknowledged  as  an  important  component 
of  workload  but  there  was  no  census  among  the  members  of  the  Terminal  Staffing  Standards 
Team  on  how  to  define  or  measure  “complexity.”  However,  they  did  identify  factors  that  serve 
to  complicate  work  in  the  tower  cabs”  (p.  35).  The  factors  identified  by  the  team  were  the 
following: 

•  Number  of  usable  hard  surface  runways. 

•  Total  usable  surface  runway  length. 

•  Longest  single  hard  surface  runway  length. 

•  Number  of  usable  taxi  ways. 
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•  Number  of  crossing  runways. 

•  Number  of  converging  runways. 

•  Number  of  Instrument  Landing  Systems. 

•  International  traffic. 

•  Terminal  type  -  VFR,  Limited  radar,  Radar,  Nonradar,  or  TRACAB. 

•  Ratio  of  total  annual  primary  instrument  operations  to  total  annual  airport  operations. 

•  Most  recent  total  annual  airport  operations. 

•  Practical  Annual  Capacity. 

•  Airspace  restrictions  (TCA,  ARSA,  none). 

•  Number  of  aircraft  based  at  the  airport. 

•  Percent  of  total  annual  airport  operations  that  are  heavy  aircraft. 

•  Percent  of  total  annual  airport  operations  that  are  helicopter. 

•  Visibility. 

•  Wind  speed  (p.  36). 

While  this  work  contains  useful  information  on  the  tasks  that  tower  controllers  perform,  it  falls 
short  of  the  analysis  of  information  requirements  that  would  be  necessary  to  provide  the 
foundation  for  display  integration.  For  example,  while  the  number  of  times  that  the  controllers 
looked  out  the  window  or  at  the  BRITE  display  were  counted,  the  information  that  the 
controllers  used  (i.e.,  the  reason  for  looking  at  the  BRITE  or  out  the  window)  was  not 
considered. 

Another  study  (Bruce,  1996)  examined  the  physical  actions  of  controllers  at  six  towers  (Austin, 
Memphis,  Milwaukee,  Philadelphia,  San  Francisco,  and  Teterboro).  The  movements  of 
controllers  in  the  cab  were  recorded  along  with  the  displays  and  controls  they  used  and  how 
much  time  was  spent  using  each  of  them.  The  purpose  of  the  study  was  to  define  the  mobility 
requirements  for  tower  controllers  to  determine  whether  handicapped  individuals  could  be 
assigned  to  towers.  Many  of  the  findings  of  this  study  point  to  the  need  for  adherence  to  basic 
human  factors  principles  of  workspace  design.  For  example,  if  the  towers  examined  had  been 
ergonomically  designed  (e.g.,  to  accommodate  the  fifth  percentile  female),  there  wouldn’t  be  the 
need  for  controllers  who  are  5  ft.  tall  and  under  to  use  a  stool  or  climb  on  the  console  to  monitor 
an  aircraft  pushback.  A  related  finding  was  the  movement  required  of  controllers  to  obtain 
information  from  various  parts  of  the  tower.  They  noted  that  “There  are  differences  by  position 
and  by  facility,  but  in  general,  we  can  conclude  that  controllers  cross  some  area  of  floor  space  an 
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average  of  three  times  per  minute”  (p  30).  They  found  that  “on  average,  controllers  move  to  use 
a  piece  of  equipment  approximately  seven  times  per  minute,  or  once  every  8-9  seconds”  (p.  31) 
and  that  “...numerous  tasks  require  physical  repositioning  because  needed  information  and 
equipment  interactions  cannot  be  accomplished  within  the  envelope  of  reach  for  one  work 
position”  (p.  37).  This  alone  suggests  the  need  for  consolidation  of  the  present  systems.  With 
the  addition  of  new  subsystems,  the  need  for  system  integration  becomes  more  critical. 

While  it  was  not  in  the  scope  of  the  Bruce  (1996)  study  to  examine  the  information  requirements 
of  tower  controllers,  the  results  do  include  the  time  that  ground  and  local  controllers  spent 
looking  outside  the  window  and  at  each  of  the  displays  in  the  tower.  The  time  spent  on  specific 
activities  varied  by  airport.  However,  on  average: 

Local  controllers  spent: 

38  percent  of  their  time  looking  out  the  window, 

22  percent  looking  at  the  BRTTE  display, 

16  percent  of  their  time  interacting  with  (looking  at,  writing  on,  passing  to 
another  controller,  etc.)  individual  flight  strips,  and 
5  percent  of  their  time  at  the  flight  strip  bay. 

Ground  controllers  spent  an  average  of: 

47  percent  of  their  time  looking  out  the  window, 

22  percent  interacting  with  individual  flight  strips, 

1 1  percent  of  their  time  at  the  flight  strip  bay,  and 
2  percent  of  the  time  looking  at  the  BRITE  display. 

Interestingly,  these  results  are  very  similar  to  those  of  an  unpublished  study  (Grossberg,  1995) 
that  took  similar  measurements  at  three  other  towers  (Baltimore,  Dulles,  and  National).  They 
found  that  local  controllers  at  those  towers  spent  an  average  of  70  percent  of  their  time  looking 
out  the  window  and  at  the  BRITE,  and  an  additional  21  percent  of  their  time  with  flight  progress 
strips.  The  ground  controllers  observed  spent  over  50  percent  of  their  time  viewing  the  airport 
surface  (out  the  window  and  on  the  BRITE)  and  30  percent  of  their  time  looking  at  the  strips. 

While  these  results  are  useful,  an  analysis  of  information  requirements  is  still  needed.  Both 
studies  addressed  how  long  controllers  spent  looking  at  the  various  displays;  however,  the  focus 
of  the  Bruce  (1996)  study  was  to  determine  controller’s  physical  requirements,  not  the 
information  requirements.  Similarly,  the  purpose  of  the  measures  taken  in  the  Grossberg  (1995) 
study  was  to  assess  the  impact  of  a  new  system  on  controller  workload  and  situation  awareness. 
For  the  purposes  of  consolidating  displays  and  developing  tools  for  controllers,  the  question  of 
what  information  the  controllers  are  looking  for  when  they  look  at  the  display  is  as  important  as 
how  long  the  controllers  find  it  necessary  to  look  at  a  display.  While  this  type  of  “cognitive  task 
analysis”  has  been  done  for  the  en  route  environment  (e.g.,  Human  Technology,  Inc.,  1990),  no 
published  reports  of  this  type  of  study  could  be  found  for  the  tower. 
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2.9  AIRPORT  SURFACE  OPERATIONS  SAFETY  ACTION  PLAN  TO  PREVENT 
RUNWAY  INCURSIONS  AND  IMPROVE  OPERATIONS 

The  Federal  Aviation  Administration’s  1998  Airport  Surface  Operations  Safety  Action  Plan  to 
Prevent  Runway  Incursions  and  Improve  Operations  was  drafted  in  direct  support  of  the 
Administrator’s  goal  to  reduce  runway  incursions  by  15  percent  of  the  1997  level  by  the  year 
2000.  (FAA,  1998).  The  plan  identified  five  major  goals  under  the  overall  goal  to  reduce 
runway  incursions.  These  goals  were  the  following  (FAA,  1998,  p.2): 

•  To  improve  strategic  planning,  data  collection  and  analysis,  human  resources 
management  and  stakeholder  participation  -  through  enhancements  in  internal 
management,  revised  guidance  and  procedures,  better  data  collection  and  analysis 
capability,  progress  on  human  resource  issues,  and  partnership  with  stakeholders. 

•  To  seek  improvements  in  pilot/controller  communications,  pilot  and  crew  training,  and 
in-cockpit  techniques  by  addressing  frequency  congestion  and  voice  delivery  issues, 
ensuring  pilot  ground  safety  awareness  training,  addressing  cockpit  procedures  and  intra¬ 
cockpit  communication  issues,  conducting  aircraft  lighting  research,  and  improving 
aircraft  conspicuity. 

•  To  provide  controllers  with  enhanced  capabilities,  tools,  and  techniques  -  by  completing 
Airport  Surface  Detection  Equipment  (ASDE)  and  Airport  Movement  Area  Safety 
System  (AMASS)  installations  and  pursuing  cost-effective  alternatives  for  mid-sized  and 
smaller  airports;  by  continuing  research  and  development  on  data  fusion  technology, 
multi-lateration,  and  other  sensors;  and  by  addressing  controller  human  resource  needs 
through  training  and  human  factors  initiatives. 

•  To  seek  improvements  in  airport  surface  facilities,  design,  and  operations  -  through 
enhancements  in  airport  surface  navigation  aids;  use  of  objective  methods  to  determine 
the  adequacy  of  existing  aids  and  services;  improvements  in  aircraft  positioning 
technique;  and  through  communication  of  lessons  learned. 

•  To  improve  communications  with  the  aviation  community  to  enhance  incursion 
awareness  -  by  highlighting  incursion  problem  areas  to  create  awareness  and  seek 
solutions;  conducting  an  airport  surface  safety  awareness  campaign;  and  improving 
dissemination  of  safety-related  information.” 

As  a  result  of  the  studies  described  above,  and  other  efforts,  several  improvements  have  been 
made  over  the  years.  For  example,  the  need  for  reliable  and  conspicuous  airport  markings  (i.e., 
runway  crossings  and  hold  short  lines)  has  received  considerable  attention  resulting  in  improved 
signage  and  markings  at  many  airports.  Also,  pilots  are  now  required  to  readback  all  “hold 
short”  instructions  as  well  as  clearances  for  take-off  or  landing.  However,  despite  the  progress 
made  in  these  areas,  the  rate  of  runway  incursions  to  total  number  of  operations  has  not 
decreased.  There  were  292  runway  incursions  reported  in  1997  and  322  in  1998  (FAA,  April 
1999).  With  66.2  million  operations  in  1998,  the  rate  of  runway  incursions  was  4.91.  In  1999 
(January  -  November),  there  were  295  runway  incursions  and  59.2  million  operations  for  a 
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runway  incursion  rate  of  4.96  (FAA,  November  1999).  The  number  of  surface  incidents  (which 
includes  runway  incursions  and  potential  runway  incursions)  has  also  increased.  The  number  of 
surface  incidents  recorded  from  January  to  November  was  774  in  1998  and  959  surface  incidents 
reported  in  1999.  It  is  possible  that  increased  awareness  has  resulted  in  an  increase  in  the 
reporting  of  these  incidents  over  the  years.  However,  there  is  nothing  that  suggests  that  the 
threat  to  aviation  safety  posed  by  runway  incursions  is  on  the  decline. 

2.10  RUNWAY  INCURSION  JOINT  SAFETY  ANALYSIS  TEAM  (JSAT) 

The  most  recent  analysis  of  pilot  and  controller  errors  in  airport  operations,  prior  to  the  present 
study,  was  conducted  by  the  Runway  Incursion  Joint  Safety  Analysis  Team  (JSAT)  In  its 
Results  and  Analysis  report  (August  11, 2000),  the  JSAT,  sponsored  by  the  Commercial 
Aviation  Safety  Team  (CAST)  and  the  General  Aviation  Joint  Steering  Committee  (GAJSC), 
reports  on  the  results  of  their  detailed  examination  of: 

•  5  NTSB  “blue  book”  accident  reports. 

•  26  additional  NTSB  reports  of  runway  incursion  accidents  at  non-towered  airports. 

•  49  operational  errors  that  occurred  between  1997  and  1998. 

•  12  pilot  deviations  that  occurred  between  1997  and  1998. 

•  123  proprietary  reports  of  pilot  deviations  from  airline  data  bases. 

While  there  is  some  commonality  of  purpose  in  the  JSAT  study  and  the  current  one,  there  are 
several  differences  that  distinguish  the  two.  First,  whereas  the  JSAT  sampled  NTSB,  operational 
error  reports  and  reports  of  pilot  deviations,  the  present  study  analyzed  more  recent  and  a  greater 
number  of  these  incidents.  Second,  the  JSAT  did  not  consider  ASRS  reports  in  their  analyses. 
Third,  while  the  focus  of  the  JSAT  work  was  to  lead  to  recommendations  to  prevent  runway 
incursions  at  towered  and  non-towered  airports  alike,  the  focus  of  the  present  analysis  was 
towered  airports.  Fourth,  the  unique  aspect  of  the  JSAT  analysis  was  the  information  acquired 
from  proprietary  airline  data  bases.  The  largest  volume  of  data,  and  the  most  useful  information, 
examined  by  the  JSAT  came  from  reports  from  pilots  and  accident  investigators  submitted  by 
proprietary  airline  databases.  These  data  bases  contained  665  reports  from  1994  -  1999. 
However,  only  123  were  judged  to  be  relevant  and  to  contain  sufficient  detail  for  analysis. 

Causal  factors  were  examined  in  the  analysis  process,  but  not  detailed  in  the  results.  The 
contributing  factors  were  described  as  follows: 

•  “Loss  of  situational  awareness  by  controllers  and/or  pilots  was  the  main  causal  factor  in 

many  of  the  incidents  reviewed”  (p.  29). 

•  “Inadequate  and/or  confusing  ATC  procedures  have  contributed  to  surface  incidents  and 
runway  incursions”  (p.30). 
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•  “Several  accidents/incidents  resulted  from  inadequate  or  misunderstood  clearances 
between  ATC  and  the  flight  crew,  including  phraseology,  readback  and  hearback 
problems”  (p.  36). 

•  “Several  incidents  identified  combined  controller  positions  and  controllers  simulcasting 
as  factors  in  reducing  pilot  situational  awareness  or  creating  confusion”  (p.  36). 

•  It  states  that  at  least  one  FAA  study  concluded  that  there  is  a  “strong  correlation  between 
teamwork,  or  more  precisely  a  lack  of  teamwork,  and  the  occurrence  of  operational 
errors”  (p.35,  but  no  reference  is  provided). 

•  With  respect  to  pilot  procedures,  complying  with  standard  operating  procedures  (SOPs) 
was  stressed  as  important  as  well  as  developing  procedures  for  ground  operations  where 
none  exist. 

The  recommendations  from  the  report  fell  into  the  following  categories: 

•  Air  traffic  controller  and  pilot  training. 

•  Training/techniques/technology  to  increase  pilot  and  controller  situational  awareness. 

•  Improving  ATC  and  flight  deck  procedures. 

•  Improved  technology  in  the  areas  of: 

-  Enhanced  surveillance. 

-  Cockpit  heads-up  displays  and  moving  map  displays. 

-  Aircraft  lighting. 

-  Airport  lighting. 

•  Crew  resource  management  for  flight  crews  and  controllers. 

•  Improved  equipment  and  procedures  for  pilot-controller  voice  communications  and 
implementation  of  data-link 

•  Improved  data  collection  techniques. 

•  Exploration  of  issues  related  to  ATC  supervision,  airport  capacity  and  runway  incursion 
prevention  awareness. 

The  report  recognized  that  improvements  are  needed  in  the  communication  realm: 

“One  of  the  weakest  areas  of  the  modem  aviation  is  the  industry’s 

continued  reliance  on  a  relatively  archaic  method  of  communicating 

information,  specifically  via  one-at-a-time  radio  transmissions.  These 
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transmissions  are  rather  frequently  garbled,  “stepped-on”,  blocked,  and 
otherwise  difficult,  if  not  impossible,  to  understand”  (p.36). 

The  recommendations  regarding  tower  communications  concerned  wider  use  of  data  link  and 
technology  that  would  allow  the  combination  of  controller  positions  without  simulcasting  to 
aircraft  on  different  frequencies.  The  other  recommendations  in  the  report  that  specifically 
address  improvements  to  the  tower  are  the  following: 

•  FAA  shall  provide  new  technology  tools  for  enhanced  surveillance  information  and 
conflict  detection. 

•  Air  traffic  service  providers  shall  install  surface  surveillance  systems. 

•  Air  traffic  service  providers  should  provide  airport  surface  surveillance  equipment  with 
conflict  alerting  capability  at  all  air  traffic  control  towers. 

(p.33) 

It  is  currently  the  role  of  the  Joint  Safety  Implementation  Team  (JSIT)  to  implement  the 
recommendations.  As  of  September  2000,  this  work  is  in  progress  and  expected  to  continue  at 
least  through  spring  of  2001. 

2.11  AN  INDEPENDENT  STUDY  OF  AMASS/ASTA  BENEFITS 


Although  almost  10  years  old.  An  Independent  Study  of  AMASS/ASTA  Benefits  (Skaliotis,  1991) 
is  as  valuable  now  as  it  was  when  it  was  published.  It  is  an  independent  and  unbiased  analysis  of 
the  projected  benefits  of  the  Airport  Movement  Area  Safety  System  (AMASS),  Airport  Surface 
Traffic  Automation  (ASTA)  and  “low  tech”  solutions  (such  as  markings,  signs,  lights  and 
education).  The  analysis  was  intended  to  be  preliminary  in  nature,  and  refined  as  the  acquisition 
and  implementation  of  these  systems  progressed.  (While  benefits  studies  have  been  conducted 
for  individual  programs,  no  other  “big  picture”  analyses  were  found  in  the  literature.)  The  report 
details  projected  benefits  in  terms  of  safety,  efficiency,  and  savings  in  delays  and  aircraft 
operating  costs.  It  estimated  that  the  total  ten  year  expected  safety  loses  were  $120  to  $210 
million  from  runway  incursion  accidents.  It  estimated  that  between  57  and  74  percent  of  this 
could  be  prevented  by  all  planned  system  elements.  The  AMASS/ASTA  share  of  the  benefit 
ranged  from  $34  to  $93  million;  lower  technology  approaches  were  estimated  to  save  from  $3 1 
to  $56  million.  These  data  lend  further  support  to  the  need  for  attention  to  low-technology 
solutions  as  well  as  the  development  of  improved  surveillance  and  monitoring  tools  for 
controllers. 


Another  interesting  conclusion  of  this  study  was  that  the  actual  number  of  runway  incursions 
may  be  more  predictive  of  where  the  next  incursion  or  accident  will  occur  than  the  incursion  rate 
(i.e.,  the  number  of  incursions  per  100,000  operations).  The  study  found  that  the  number  of 
incursions  was  not  well  correlated  to  the  number  of  operations.  It  suggested  that  local  factors  at 
particular  airports  are  more  important  than  high  operations  levels  at  determining  the  risk  of  an 
accident/incident. 
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3.  STUDIES  OF  SYSTEM  INTEGRATION 


“What  often  happens  in  the  evolution  of  system  design  is  a  proliferation  of 
unintegrated  subsystems,  each  with  its  own  unique  interface...  Integrating 
separately  developed  components  . .  .is  one  of  the  biggest  human  factors 
challenges  facing  the  FA  A...  lack  of  integration  into  existing  operational  and 
technological  contexts  is  an  obstacle  to  improved  usability  and  productivity.” 

Cardosi  and  Murphy  (1995)  p.  228. 

3.1  SYSTEM  INTEGRATION 

The  tower  environment  is  a  human  factors  “poster  child”  for  the  need  for  system  integration.  It 
is  crucial,  however,  that  the  goal  of  the  integration  is  to  support  the  controllers’  tasks,  and  not 
solely  for  the  sake  of  integration,  or  to  save  space.  Ideally,  system  integration  would  be  based 
solely  on  operational  requirements.  That  is,  the  primary  goal  of  integrating  displays  and  controls 
should  be  to  structure  the  controller’s  task  to  maximize  efficiency  and  minimize  the  probability 
of  human  error.  A  related  goal  is  to  make  the  system  “error  tolerant,”  since  some  human  error  is 
inevitable,  the  system  needs  to  be  designed  to  be  able  to  catch  controller  errors  and  bring  them  to 
the  attention  of  the  controller  in  time  for  the  effects  of  the  error  to  be  mitigated.  Because  system 
integration  must,  by  definition,  be  system-specific,  nothing  in  the  existing  literature  can  provide 
a  roadmap  for  system  integration  in  the  tower  today.  The  components  of  existing  systems  that 
satisfy  the  controllers’  information  requirements  need  to  be  integrated  with  the  controllers’ 
information  requirements  of  the  follow-on  subsystems  to  best  determine  if/how  the  displays  (or 
components  of  the  displays)  should  be  integrated.  The  goal  of  this  integration  should  be  to 
support  the  controllers’  tasks;  this  will  help  to  minimize  controller  error  and  increase  efficiency. 
Despite  the  fact  that  work  needs  to  be  done  to  determine  how  today’s  (and  tomorrow’s)  tower 
displays  should  be  integrated,  the  studies  that  have  been  done  to  date  on  system  integration  in  the 
tower  are  worth  reviewing  for  the  “lessons  learned.” 

3.1.1  Air  Traffic  Control  Towers  Equipment/Svstem  Integration  Study  Conducted  by 
Transport  Canada 

The  most  comprehensive  study  of  the  integration  of  tower  systems  was  conducted  by  Reynolds, 
Last,  Camp,  Matthews,  Kwan,  and  McDonald  (1994)  for  Transport  Canada.  The  aim  of  this 
study  was  the  “identification  of  operational  requirements  and  assessment  of  present  Human- 
Machine  Interface  (HMI)  with  a  view  to  equipment  integration  [in  Canada]”  (p.  5).  The 
subsystems  that  were  considered  for  integration  included  the  tower  cab  workstation,  airport 
lighting.  Airport  Surface  Detection  Equipment  (ASDE),  Airport  Terminal  Information  System 
(ATIS),  the  communications  systems,  and  others. 

Many  of  these  subsystems  (if  not  their  functionality)  were  specific  to  Canada.  While  a  specific 
mapping  of  the  systems  to  those  used  in  towers  in  the  U.S.  is  outside  the  scope  of  this  report,  the 
goals  of  the  Canadian  effort  are  the  same  as  what  we  hope  to  achieve  in  the  U.S.  The  six  criteria 
used  for  system  integration  in  the  1994  Canadian  study  are  broadly  applicable;  they  consisted  of 
the  following: 
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1 .  Input/Output  Devices  -  the  integration  of  subsystems  should  result  in  the 
reduction  of  display  clutter  and  simplification  of  input  devices  without 
compromising  the  operational  environment.  The  number  and  complexity  of  input 
devices  and  the  number  of  operator  actions  required  to  access  a  particular  piece  of 
information  should  be  minimized. 

2.  Functional  Requirements  Specifications  -  subsystems  should  be  integrated  if  this 
will  assist  in  meeting  operational  requirements. 

3.  Shared  Data  -  subsystems  that  utilize  common  data  should  be  integrated  to 
simplify  the  interfaces  and  reduce  the  number  of  communication  paths. 

4.  Compatible  Technology  -  subsystems  that  are  based  on  compatible  technology 
are  better  candidates  for  integration  than  subsystems  that  are  not  technologically 
compatible. 

5.  Age  -  the  functions  performed  by  older  subsystems  may  be  candidates  for 
integration  because  equipment  replacement  can  be  justified,  whereas  the 
integration  of  functions  performed  by  new  subsystems  making  new  equipment 
redundant  may  be  more  difficult  to  justify. 

6.  Space  -  the  integration  of  subsystems  in  the  tower  should  minimize  space 
requirements. 

While  it  is  interesting  to  consider  this  effort  at  system  integration,  it  is  important  to  note  that  the 
goal  should  not  be  solely  to  reduce  clutter  without  compromising  the  operational  environment. 
Rather,  the  goal  of  system  integration  should  be  to  enhance  the  operational  environment.  As  the 
amount  and  complexity  of  traffic  increases,  the  need  for  displays  that  support  the  controller’s 
task,  e.g.,  ones  that  decrease  the  likelihood  of  critical  errors,  becomes  even  more  important. 

Also,  it  is  simply  sound  human  factors  practice  to  require  that  all  of  the  information  that  a 
controller  needs  to  perform  critical  tasks  is  present  and  that  minimum  action  is  required  to  access 
information  that  is  frequently  used.  Furthermore,  all  subsystems  should  be  designed  and 
integrated  so  that  the  controller  does  not  need  to  enter  the  same  data  into  more  than  one  system. 
A  workstation  with  subsystems  that  are  technologically  incompatible  can  place  an  undue  burden 
on  the  user.  Such  incompatibility  can  result  in  distracting  nuisances  or  require  the  controller  to 
choose  between  discrepant  information. 

3.1.2  System  Inte2ration  Analysis  for  Future  Tower  Cab  Configurations/Svstems  in  the 
U.S. 

In  1978  a  “tower-cab  integration  analysis”  was  conducted  in  the  United  States  to  identify  issues 
associated  with  the  introduction  of  (the  then)  new  systems  into  the  tower  cab  (Hobbs,  et  al., 
1978).  The  existing  tower  cab  environment  was  extensively  studied,  along  with  the 
characteristics  of  the  systems  to  be  introduced.  For  the  purposes  of  this  study,  these  “new” 
systems  were  the  following: 
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•  Airport  Surface  Detection  Equipment  -  ASDE-3. 

•  Tower  Airport  Ground  Surveillance  System. 

•  Terminal  Information  Processing  System. 

•  ARTS-2  and  ARTS-3  Enhancements. 

The  motivation  for  integrating  the  new  systems  with  the  existing  systems  was  primarily  one  of 
space;  several  of  the  new  systems  had  large  displays  associated  with  them  and  the  limited  space 
in  the  tower  necessitated  some  consolidation.  While  the  human  factors  aspects  of  this  integration 
were  to  be  examined,  they  were  clearly  not  the  driving  force  of  the  integration.  In  fact,  the  only 
human  factors  issues  that  were  addressed  were  maintaining  the  controllers’  abilities  to:  maintain 
visual  contact  with  aircraft,  move  about  the  cab  as  necessary,  use  the  displays/controls  from  a 
standing  position  and  under  the  wide  range  of  ambient  lighting  conditions  inherent  in  tower 
operations.  The  purpose  of  integration,  as  seen  in  this  study,  was  to  reduce  controller  workload 
and  to  reduce  the  crowding  of  the  workspace.  These  goals  were  seen  as  paramount  to  safely 
increasing  controller  productivity. 

The  Hobbs,  et  al.  (1978)  report  stated  that  “no  broadly  applicable  findings  can  be  established 
through  these  efforts”  (p.  18-2)  in  part  because  of  the  unique  nature  of  each  tower  cab  and  airport 
layout.  This  caveat  will  always  be  applicable  to  tower  issues.  While  the  specific  errors  that  are 
most  likely  to  be  made  at  a  given  airport  may  be  airport  specific,  the  types  of  errors  are 
somewhat  universal.  Similarly,  there  are  many  tower-specific  factors  that  need  to  be  considered 
in  the  design  of  individual  towers,  such  as:  the  physical  layout  of  the  airport  surface,  buildings  on 
and  around  the  airport  surface,  visual  obstructions  in  and  outside  of  the  tower  cab,  etc.),  runway 
and  taxiway  configurations,  and  local  weather  patterns  (visibility,  winds,  etc.).  However,  the 
type  of  information  needed  and  human  factors  principles  that  should  govern  the  integration  of 
this  information  are  generally  applicable. 

This  series  of  three  documents  (Hobbs,  et  al.,  1977;  Clapp,  et  al.,  1978;  Hobbs,  et  al.,  1978) 
contains  a  thoughtful  approach  to  system  integration  in  the  tower.  While  the  details  of  the 
suitability  of  these  particular  systems  for  system  integration  are  outside  the  scope  of  this  report, 
they  should  be  of  interest  to  anyone  charged  with  the  task  of  system  integration.  The  specific 
recommendations  contained  in  the  documents,  however,  are  out-dated  and  point  to  the  need  for 
similar  work  to  be  conducted  on  today’s  systems  with  an  eye  toward  the  implementation  of  new 
subsystems. 
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4.  SUMMARY  OF  RESEARCH  ON  SURFACE  INCIDENTS 
AND  STUDIES  OF  SYSTEM  INTEGRATION 


The  studies  reviewed  offer  a  consensus  on  the  causes  of  surface  incidents  that  occur  as  the  result 
of  controller  errors.  The  primary  controller-related  factors  identified  were: 

•  Forgetting  about  the  presence  of  aircraft  on  a  runway,  the  closure  of  a  runway  or  a 
clearance  that  he/she  had  issued  (includes  failure  to  verify  the  location  of  the  aircraft). 

•  Failure  to  anticipate  the  required  separation  or  miscalculation  of  the  impending 
separation. 

•  Communication  errors  -  readback/hearback  errors,  or  issuing  an  instruction  other  than  the 
one  the  controller  intended  to  issue. 

•  Lack  of,  or  incomplete,  coordination  between  controllers. 

•  Absence  of  a  supervisor  (who  was  not  working  a  control  position). 

The  experience  level  of  the  controllers  involved  was  not  identified  as  a  causal  factor,  as 
controllers  of  all  experience  levels  were  involved  in  the  incursions  studied.  However,  the 
controllers  with  the  most  experience  were  acting  in  a  supervisory  (supervisor  or  controller-in¬ 
charge)  role  at  the  time  of  the  incident  and  were  usually  working  control  positions 
simultaneously.  No  other  factors  were  determined  to  be  significant  causal  factors. 

All  of  these  factors  point  to  the  need  for  increased  redundancy  in  the  tower.  Clearly  an  “extra  set 
of  eyes,”  whether  they  be  human  or  electronic,  (preferably  with  some  analytic  ability  attached) 
can  go  a  long  way  toward  providing  the  necessary  oversight  to  prevent  operational  errors  in  the 
tower.  Memory  (and  to  a  lesser  extent,  judgment)  will  fail  at  times,  no  matter  how  experienced, 
well-trained,  motivated,  or  conscientious  an  individual  is;  it  is  this  fallibility  that  well-designed 
automated  tools  can,  and  should,  be  implemented  to  offset. 

The  need  to  both  improve  the  current  voice  communication  system  and  find  other  reliable  and 
timely  means  for  exchanging  information  critical  to  the  safe  and  efficient  flow  of  surface  traffic 
has  been  demonstrated  by  both  pilot  and  controller  opinion  (survey  data)  and  objective  measures 
of  voice  communications.  With  most  of  the  controllers  at  the  busiest  airports  reporting  that  they 
could  not  always  access  the  frequency  when  needed  which  transmissions  were  often  stepped-on, 
the  implications  for  the  effect  of  the  projected  increases  in  air  traffic  are  clear.  While  voice 
communications  are  surprisingly  accurate,  the  increasing  volume  and  complexity  of  the  traffic  at 
busy  airports  makes  voice  communications  a  tenuous  safety  link. 

As  the  amount  and  complexity  of  traffic  increases,  the  need  for  systems  that  support  the 
controller’s  task,  e.g.,  ones  that  decrease  the  likelihood  of  critical  errors,  becomes  even  more 
important.  With  more  systems  being  introduced  into  the  tower  environment,  the  need  for 
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thoughtful  integration  of  these  systems  becomes  increasingly  critical;  a  workstation  with 
subsystems  that  are  technologically  incompatible  places  an  undue  burden  on  the  user  and  can 
threaten  safety  and  efficiency.  The  need  for  attention  to  system  integration  issues  in  the  tower 
was  evident  from  the  frequent  movements  needed  by  tower  controllers  to  accomplish  their  tasks, 
by  the  obstructions  to  controllers’  vision  of  the  airport  surface  created  by  multiple  monitors  on 
the  consoles,  and  by  the  steady  stream  of  additions  of  new  subsystems.  Because  system 
integration  must,  by  definition,  be  system-specific,  nothing  in  the  existing  literature  can  provide 
a  roadmap  for  system  integration  in  the  tower  today.  However,  there  are  human  factors 
principles  to  guide  the  integration  process. 

The  primary  goal  of  integrating  displays  and  controls  should  be  to  structure  the  controller’s  task 
to  maximize  efficiency  and  minimize  the  probability  of  human  error.  A  related  goal  is  to  make 
the  system  “error-tolerant,”  that  is,  since  human  error  is  inevitable,  the  system  needs  as  a  whole 
needs  to  be  designed  to  catch  errors  and  bring  them  to  the  attention  of  the  controller  in  time  to  be 
able  to  remedy  the  situation.  All  subsystems  should  be  designed  and  integrated  so  that  the 
controller  does  not  need  to  enter  the  same  data  into  more  than  one  system.  Similarly,  the 
systems  should  not  offer  conflicting  information  (e.g.,  based  on  data  from  different  sources). 
Each  sub-system  needs  to  be  examined  with  respect  to  the  information  it  requires  (i.e.,  data- 
entry),  the  information  it  displays,  and  the  overlap,  if  any,  with  other  systems.  It  is  only  through 
such  a  holistic  approach  safety  and  efficiency  can  be  maximized. 
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5.  ANALYSIS  OF  SAFETY  DATA 


In  order  to  determine  whether  the  most  recent  safety  data  support  the  conclusions  of  previous 
work,  an  extensive  analysis  of  data  was  undertaken.  The  following  safety  data  were  examined: 

•  FAA  reports  of  tower  operational  errors  and  deviations. 

•  NTSB  accident  and  incident  reports  (and  recommendations  to  the  FAA). 

•  Reports  filed  by  tower  controllers  to  the  Aviation  Safety  Reporting  System  (ASRS). 

•  ASRS  reports  filed  by  pilots  involving  runway  transgressions. 

•  FAA  pilot  deviations  in  tower  airspace. 

These  accidents  and  incidents  were  analyzed  in  an  attempt  to  determine  the  types  of  errors  made 
in  the  airport  environment;  to  identify  significant  factors  associated  with  these  errors,  and  to 
determine  what  improvements  to  the  tower  could  help  to  prevent  or  mitigate  these  errors.  As  in 
the  previous  section,  a  “runway  incursion”  is  defined  as  “any  occurrence  at  an  airport  involving 
an  aircraft,  vehicle,  person,  or  object  on  the  ground  that  creates  a  collision  hazard  or  results  in 
loss  of  separation  with  an  aircraft  taking  off,  intending  to  take  off,  landing  or  intending  to  land” 
(FAA,  November,  1999,  p.  G-4);  and  a  “surface  incident”  is  defined  as  “any  event  where 
unauthorized  or  unapproved  movements  occurs  within  the  movement  area  or  an  occurrence  in 
the  movement  area  associated  with  the  operation  of  an  aircraft  that  affects  or  could  affect  the 
safety  of  flight”  (Ibid.,  p.  G-4).  Again,  the  recommendations  offered  in  this  document  were 
intended  to  focus  on  identified  tower  “shortfalls”  and  not  training,  procedures  or  problems 
peculiar  to  an  individual  facility.  However,  the  same  analysis  had  other  applications:  for 
example,  it  was  used  to  develop  recommendations  for  the  runway  safety  workshops  and  to 
develop  a  booklet  on  runway  incursion  prevention  for  pilots  and  controllers. 

5.1  OVERVIEW  OF  REVIEWED  DATA  BASES 

There  are  several  useful  data  bases  contained  in  the  National  Aviation  Safety  Data  Analysis 
Center  (NASDAC).  Each  has  its  own  advantages  and  limitations.  The  data  base  as  a  whole  is 
extremely  well  designed  and,  in  the  hands  of  an  experienced  analyst,  allows  for  quick  and 
informative  searches  and  summaries.  It  is  no  less  than  amazing  that  analyses  that  five  years  ago 
would  have  taken  weeks  (without  this  well-structured  data  base)  can  now  be  accomplished  in 
less  than  an  hour.  Nonetheless,  such  analyses  can  only  be  based  on  the  information  that  is  coded 
into  the  system.  Anything  beyond  this  must  be  gleaned  from  other  sources. 

Some  incident  reports  are  more  useful  than  others,  from  a  human  factors  standpoint.  It  is  not 
enough  to  know  what  happened,  we  must  also  be  able  to  discern  why  it  happened;  it  is  the  causes 
of  the  errors  that  point  to  the  remedy.  For  example,  a  report  may  say  that  Aircraft  1  was  cleared 
to  takeoff  on  Runway  X  and  Aircraft  2  was  cleared  to  land  on  intersecting  Runway  Y  resulting  in 
a  runway  incursion.  With  this  information  alone,  it  is  impossible  to  determine  the  nature  of  the 
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error.  Did  the  same  controller  issue  both  clearances  and  forgot  that  one  had  been  issued?  Was 
there  an  unanticipated  delay  in  a  takeoff  that  went  unnoticed  by  the  controller?  Did  a  controller 
fail  to  coordinate  a  clearance  with  another  controller? 

Investigations  of  operational  errors  and  deviations  describe  what  happened  and  attempt  to 
determine  the  underlying  factors  that  contributed  to  the  errors.  From  an  objective  standpoint, 
there  are  several  concerns  about  these  data.  First,  there  is  the  perception  that  not  every 
operational  error  is  reported  and  included  in  the  data  base.  If  this  is  the  case,  then  the  data  may 
be  biased  towards  including  some  type  of  errors  over  others;  this  could  affect  what  would 
suggest  effective  remedies.  A  second  concern  is  that  the  investigation  is  of  a  nature  that  may  not 
lend  itself  to  full  disclosure  on  the  part  of  the  controllers  involved  or  generate  an  interest  in 
preventing  such  errors.  Thus,  there  may  have  been  factors  that  contributed  to  the  error  that  were 
not  identified  in  the  reports.  Nonetheless,  the  reports  of  operational  errors  and  deviations  are 
very  useful.  The  events  are  investigated  by  a  specialist  from  the  facility  who  is  (or  at  least 
should  be)  intimately  familiar  with  the  operations  at  that  facility  and  the  reports  contain  a  great 
deal  of  information  on  the  operational  conditions  at  the  time  of  the  incident. 

The  reports  of  pilot  deviations,  usually  filed  by  a  controller,  contain  an  extremely  succinct 
account  of  what  happened.  The  reports  usually  lack  any  detail  as  to  why  the  incident  occurred, 
thus,  their  usefulness  is  extremely  limited.  Reports  submitted  to  the  ASRS,  on  the  other  hand, 
are  often  very  helpful  in  identifying  why  certain  errors  happened,  since  the  reporters  often 
include  details  that  they  would  be  reluctant  to  report  to  investigative  officials.  However,  ASRS 
reports  often  lack  critical  objective  details.  More  importantly,  since  reporting  is  voluntary,  this 
data  base  cannot  provide  incidence  data  (that  is,  they  cannot  provide  information  on  how  often 
something  happens). 

Reports  of  accidents  and  incidents  investigated  by  the  NTSB  can  vary  from  brief  and  succinct  to 
lengthy  and  detailed,  depending  on  the  extensiveness  of  the  investigation.  NTSB  also  issues 
recommendations  to  remedy  the  problems  identified  in  their  investigations. 

While  none  of  these  data  bases  can  present  a  complete  picture  of  incidents  that  affect  the  safety 
of  tower  operations,  each  of  them  provides  a  different  perspective  that  complements  the  others. 
These  data  bases  were  examined  to  ascertain  converging  evidence  on  the  nature  of  pilot  and 
controller  errors  in  the  tower  environment  and  to  identify  potential  remedies. 

5.2  TOWER  OPERATIONAL  ERRORS  AND  DEVIATIONS 

FAA  reports  of  tower  operational  errors  and  deviations  from  the  busiest  towers  in  the  U.S.  (what 
was  then  Levels  3, 4,  and  5)  that  were  contained  in  the  NASDAC  data  base  as  of 
November  15, 1999  were  examined.  This  included  89  reports  from  Level  3  towers,  68  from 
Level  4  facilities  and  99  from  Level  5  towers  for  a  total  of  256  reports.  These  reports  were  of 
incidents  that  occurred  between  January  1997  and  June  1999.  These  errors  were  analyzed  in  an 
attempt  to  determine  the  types  of  errors  made  by  tower  controllers  and  identify  significant  factors 
associated  with  these  errors  in  order  to  determine  what  improvements  to  the  tower  could  help  to 
prevent  or  mitigate  these  errors.  Again,  the  recommendations  offered  were  intended  to  focus  on 
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identified  tower  “shortfalls”  and  not  training,  procedures  or  problems  peculiar  to  an  individual 
facility. 

The  FAA  reports  of  operational  errors  and  deviations  are  lengthy  form-filled  reports  completed 
by  an  FAA  investigator  (usually  a  supervisor  or  quality  assurance  specialist)  from  the  facility. 
These  reports  provide  detailed  information  on  the  operational  environment  at  the  time  of  the 
error  or  deviation.  The  reports  describe  the  event,  identify  contributing  factors  (such  as  traffic 
complexity,  weather,  number  of  aircraft,  or  whether  training  was  in  progress  at  the  time)  and  list 
“controller  contributions”  that  describe  the  types  of  errors  (e.g.,  readback/hearback, 
phraseology).  The  standardization  of  these  reports  allows  for  easy  analysis  and  summary 
statistics. 

The  reports  of  operational  errors  and  deviations  also  contain  a  rating  of  the  complexity  of  the 
traffic  at  the  time  of  the  incident.  The  complexity  is  rated  on  a  five-point  scale  consisting  of  the 
following  responses:  “easy,”  “below  average,”  “average,”  “above  average,”  and  “complex.” 
Twenty-three  percent  of  the  reports  specified  that  the  complexity  was  above  average  (16  percent) 
or  complex  (7  percent).  Thirty-two  percent  of  the  reports  specified  an  average  level  of 
complexity,  20  percent  below  average  and  25  percent  as  easy.  While  the  rating  of  the 
complexity  of  the  traffic  does  not  appear  to  be  a  significant  factor  in  operational  errors  and 
deviations,  the  number  of  aircraft  was  listed  as  a  contributing  factor  in  27  percent  of  the  reports. 
Weather  was  listed  as  a  factor  in  8  percent  of  the  reports.  It  is  important  to  note  that  this 
information  alone  -  for  these  and  other  factors  -  is  not  able  to  speak  to  the  effect  of  that  factor 
(such  as  complexity)  on  errors  and  deviations.  In  order  to  determine  the  relative  risk  associated 
with  a  factor  (such  as  complex  traffic),  one  would  have  to  look  at  the  number  of  errors  and 
deviations  associated  with  that  factor  as  a  function  of  the  total  number  of  operations  associated 
with  that  factor. 

An  analysis  of  the  contributing  factors  as  identified  in  the  reports  revealed  that  the  top  five 
factors  overall  were:  “aircraft  observation,”  “coordination,”  “communication  error,”  “visual 
data,”  and  “ground  operations.”  [The  definitions  of  these  terms  as  contained  in  the  data  base  are 
presented  in  Appendix  A.]  As  can  be  seen  in  Figure  2,  “aircraft  observation”  was  the  most 
common  factor  noted  in  the  operational  errors  and  deviations,  followed  by  “coordination,” 
“communication  error,”  “visual  data,”  and  ground  operations.  The  different  level  facilities  had  a 
slightly  different  order  of  the  top  five  factors  listed.  For  Level  5  towers  (the  busiest)  the  top  five 
factors  were: 

•  “Aircraft  observation”  -  55  percent. 

•  “Coordination”  -  39  percent. 

•  “Visual  data”  -  39  percent. 

•  “Complex  runway  configuration”  -  37  percent. 

•  “Communication  error”  -  36  percent. 
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•  “Complexity  -  number  of  aircraft”  -  29  percent. 

For  Level  4  towers,  the  most  frequently  identified  factors  were: 

•  “Aircraft  observation”  -  68  percent. 

•  “Coordination”  -  59  percent. 

•  “Ground  operations”  -  46  percent. 

•  “Visual  data”  -  34  percent. 

For  Level  3  towers,  the  top  five  factors  were: 

•  “Aircraft  observation”  -  58  percent. 

•  “Communication  error”  -  45  percent. 

•  “Coordination”  -  39  percent. 

•  “Visual  data”  -  35  percent. 

•  “Ground  operations”  -  3 1  percent. 

The  most  common  “controller  contributions”  listed  overall  were: 

•  “Aircraft  observation  -  actual  observation  of  aircraft”  -  42  percent. 

•  “Improper  use  of  visual  data  -  taking  off’  -  28  percent. 

•  “Ground  operations  -  taxiing  across  runway”  -  22  percent. 

•  “Improper  use  of  visual  data  -  landing”  -  16  percent. 

•  “Communications  error  -  misunderstanding”  -  16  percent. 
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Figure  2.  Factors  Contributing  to  Tower  Operational  Errors  and  Deviations  Identified 

by  FAA 

Generally,  the  factors  do  not  lend  themselves  to  remedies  for  the  errors.  A  notable  exception  is 
“inappropriate  use  of  displayed  data  -  failure  to  project  future  status  of  displayed  data.”  To 
illustrate,  if  several  reports  identify  “aircraft  observation  -  actual  observation  of  aircraft,”  this 
could  mean  a  number  of  different  things,  such  as:  the  controller  did  not  verify  the  position  of  the 
aircraft  as  required;  that  the  aircraft  was  at  one  location  (e.g.,  runway  intersection)  when  the 
controller  assumed  the  aircraft  was  at  another  (e.g.,  full  length);  or  that  the  controller  forgot 
he/she  had  cleared  an  aircraft  into  “position  and  hold”  and  then  (less  than  one  minute  later) 
cleared  another  aircraft  to  land  on  the  same  runway.  In  none  of  these  cases,  does  “aircraft 
observation”  point  to  a  remedy,  because  the  potential  remedies  in  each  case  are  slightly  different. 
One  the  other  hand,  “failure  to  project  future  status  of  displayed  data”  -  if  it  were  to  prove  to  be  a 
significant  factor  in  operational  errors  -  points  to  a  need  for  a  tool  that  projects  the  aircraft’s 
position  and  predicts  conflicts. 

There  were  no  factors  in  the  form  (available  for  the  investigation  or  to  check)  that  listed  a 
common  type  of  error  identified  in  the  literature,  i.e.,  forgetting.  If  a  controller  forgot  that  a 
runway  was  closed,  it  was  often  coded  as  "failure  to  coordinate  runway  closure.”  In  a  case  in 
which  the  controller  forgot  that  he  cleared  an  aircraft  into  position  and  hold  and  then  cleared 
another  aircraft  to  land  on  the  same  runway,  the  controller  contribution  codes  were  listed  as 
“aircraft  observation  -  actual  observation  of  aircraft,”  “improper  use  of  visual  data  -  landing,” 
“ground  operation  -  holding  in  position  for  takeoff,”  and  “communication  error  -  other.” 

Other  key  human  factors  information  is  either  not  coded  or  is  coded  inconsistently.  For  example, 
one  of  the  factors  identified  in  the  literature  as  being  potentially  problematic  was  the  absence  of  a 


29 


supervisor  (or  “another  set  of  eyes”)  who  was  not  (busy)  working  a  control  position.  While 
many  of  the  reports  state  whether  or  not  the  supervisor  was  aware  of  the  developing  error,  or 
engaged  in  other  tasks,  most  of  the  reports  do  specify  whether  the  supervisor  or  controller  in 
charge  was  also  working  a  position. 

For  these  reasons,  each  of  the  reports  in  the  data  base  was  analyzed  independently  so  that  a 
human  factors  assessment  of  the  errors,  independent  of  the  FAA  analysis,  could  be  conducted. 
During  this  analysis,  it  was  determined  that  five  of  the  reports  from  the  Level  5  towers  did  not 
contain  enough  detail  to  determined  why  the  events  occurred.  Furthermore,  the  events  were  too 
old  to  have  the  original  report  on  file  at  the  FAA.  Because  of  this,  those  five  reports  were 
dropped  from  subsequent  analysis,  leaving  a  total  of  251.  The  results  of  this  analysis  are  shown 
in  Figure  3. 


CO 

■e 

o 

CL 
CD 
ti : 


C 

0) 

e 

<D 

Q. 


so  r 


40 


30+ 


201 


10+ 


_ .18 . 

18 

.  22 

10 

I 

;  : 

i  ! 

M  E 

o-  UJ 
<D  c 

is 

£=  CD 

c  o 
o  C 
O  u 
E 
E 

Q 


_a>  g 

EiS 

c  c 
o  o 

°is 

c 

~2 

o 

o 

O 


<D  O 
__  ^ 
O  *- 
i—  O 

cLi- 

O 

A 


2  § 
o  s 

to 
O  O 
W  CL 

c 

<D  O 

CL 

3 

CO 


14%  Aircraft 
5%  Runway  was  closed 
L  3%  Vehicle  on  Runway 


Figure  3.  Factors  Contributing  to  Tower  Operational  Errors  and  Deviations  Identified 

by  Independent  Analysis 


Recall  that  the  review  of  the  literature  showed  that  the  most  common  controller-related  factors 
identified  in  surface  incidents  were: 


•  Forgetting  about  the  presence  of  aircraft  on  a  runway,  the  closure  of  a  runway  or  a 
clearance  that  he/she  had  issued  (includes  failure  to  verify  the  location  of  the  aircraft). 

•  Failure  to  anticipate  the  required  separation  or  miscalculation  of  the  impeding  separation. 
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•  Communication  errors  -  readback/hearback  errors,  issuing  an  instruction  other  than  the 
instruction  the  controller  intended  to  issue. 

•  Lack  of,  or  incomplete,  coordination  between  controllers. 

•  Absence  of  a  supervisor  (who  was  not  working  a  control  position). 

Each  of  the  251  reports  were  analyzed  for  significant  human  factors,  including  the  following: 

•  Controller  forgot  [about  an  aircraft  (e.g.,  that  the  controller  had  cleared  an  aircraft  for 
takeoff,  landing  or  to  cross  a  runway);  about  a  vehicle  on  the  runway;  that  a  runway  was 
closed]. 

•  Communication  error  between  controller  and  pilot. 

•  Poor  coordination  between  controllers. 

•  Absence  of  a  supervisor  who  was  not  working  a  control  position. 

•  Whether  improved  memory  aids  would  have  been  useful. 

•  Whether  improved  surveillance  and  monitoring  equipment  would  have  been  useful6. 

5.2.1  Memory  Lapses 

The  most  common  contributing  factor,  occurring  in  27  percent  of  the  operational  errors  and 
deviations  examined,  was  the  controller  “forgetting”  something.  In  15  percent  of  the  reports,  the 
controller  had  forgotten  about  an  aircraft  (such  as  one  that  had  been  cleared  to  land  or  one 
holding  at  the  end  of  a  runway).  In  3  percent  of  the  operational  errors  and  deviations  examined, 
the  controller  forgot  that  there  was  a  vehicle  on  the  runway.  In  an  additional  5  percent  of  the 
cases,  the  controller  forgot  that  the  runway  was  closed.  Other  memory  failures  accounted  for  an 
additional  4  percent  of  the  incidents  examined. 

5.2.2  Controller-Pilot  Voice  Communication 


The  second  most  common  element  found  in  this  analysis  of  operational  errors  and  deviation  was 
a  communication  error  between  pilots  and  controllers;  miscommunication  was  found  to  be  a 
factor  in  19  percent  of  the  incidents.  Interestingly,  the  “communication”  flag  was  checked  in  41 
percent  of  the  reports  by  the  FAA  investigator  of  the  error.  The  primary  reason  for  this 
difference  was  the  presumed  definition  of  “communication  error.”  In  the  FAA  analysis,  the  flag 
was  checked  in  a  variety  of  instances,  such  as  a  miscommunication  between  a  pilot  and 
controller,  two  controllers,  or  a  vehicle  driver  and  a  controller;  or  when  there  was  an  issue  of 


6  Improved  surveillance  and  monitoring  equipment  was  judged  to  have  been  potentially  useful  in  cases  in  which: 
the  controller  could  not  see  the  aircraft  from  the  tower,  the  runway  was  occupied  by  a  vehicle  or  another  aircraft 
(while  another  vehicle  was  cleared  to  cross,  takeoff  from,  or  land  on,  that  runway),  and  the  situation  was  such  that  it 
would  have  been  possible  for  an  alerting  system  to  provide  a  warning  in  time  for  the  controller  and/or  pilot  to  take 
effective  action. 
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phraseology.  In  the  present  analysis,  the  definition  of  “communication”  was  limited  to  a 
miscommunication  between  pilots  and  controllers,  usually  readback/hearback  errors;  if  there  was 
a  miscommunication  between  two  or  more  controllers,  it  was  coded  as  a  “coordination”  issue. 

5.2.3  Controller-Controller  Coordination 


Another  notable  difference  is  the  frequency  of  the  indication  of  a  “coordination”  issue.  In  the 
present  analysis,  this  was  noted  if  there  was  a  failure  of  one  controller  to  relay  needed 
information  to  another  controller  or  a  failure  to  obtain  approval  for  a  specific  operation  (such  as  a 
failure  to  coordinate  a  runway  crossing).  The  “coordination”  issue  was  noted  in  18  percent  of 
the  reports  in  this  analysis,  and  44  percent  in  the  FAA  analysis,  the  reasons  for  this  difference  are 
unclear. 

5.2.4  Absence  of  a  Supervisor 

The  absence  of  a  supervisor  (who  was  not  working  a  control  position)  was  noted  in  11  percent  of 
the  operational  errors  and  deviations  examined.  However,  it  is  important  to  note  that  this  factor 
was  not  able  to  be  consistently  coded  because  many  of  the  reports  do  not  explicitly  contain  this 
information.  The  reports  may  say  that  the  supervisor  was  “unaware”  that  an  error  was 
developing;  however,  many  did  not  specifically  state  whether  or  not  the  supervisor  was  in  the 
tower  cab  at  the  time.  In  many  cases,  it  was  the  supervisor  (or  controller-in-charge)  that 
prevented  a  bad  situation  from  getting  much  worse.  Obviously,  this  is  an  issue  that  merits 
further  investigation. 

5.2.5  Areas  Suggesting  the  Need  for  Further  Research 

There  were  four  other  factors  that  suggest  the  need  for  further  research;  these  were:  peripheral 
duties  imposed  by  traffic  management  duties.  Land  and  Hold  Short  Operations  (LAHSO),  effects 
of  working  combined  positions,  situation  awareness  at  the  onset  of  assuming  a  position,  and 
intersection  takeoffs. 

5.2.5.1  Peripheral  Traffic  Management  Duties  -  The  additional  duties  imposed  by  automated 
traffic  management  systems,  such  as  recording  delay  times,  do  nothing  to  enhance  the  controllers 
awareness  of  the  traffic  situation  and,  in  fact,  can  be  a  distraction.  One  controller  involved  in  an 
operational  error  commented  that  “DSP  (Departure  Sequencing  Program)  staffed  at  the  ground 
control  position  is  a  safety  hazard  -position  should  be  manned  by  TMC  (traffic  management 
coordinator)  position”  (operational  error  report  10/6/98).  Another  operational  error  report  states 
that,  “Although  not  a  direct  causal  factor  to  this  error,  some  members  of  the  [investigation]  team 
felt  that  because  there  was  not  a  TMC  [Traffic  management  coordinator]  on  duty,  the  controller 
was  preoccupied  with  ensuring  that  correct  delay  times  were  recorded  on  the  flight  progress  strip 
at  the  time  of  the  incident.”  The  degree  to  which  these  peripheral  duties  interfere  with  primary 
duties  needs  to  be  investigated.  Meanwhile,  it  is  clear  that  duties  that  are  peripheral  to  the 
primary  duties  of  the  tower  controllers  should  be  automated  or  performed  by  a  traffic 
management  coordinator,  whenever  possible. 
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5.2.5.2  LAHSO  -  Another  area  of  concern  in  the  operational  error  reports  concerns  Land  and 
Hold  Short  Operations  (LAHSO).  Seven  percent  of  the  operational  errors  and  deviations 
examined  from  the  Level  5  facilities  cited  that  LAHSO  operations  were  in  effect  at  the  time  of 
the  incident.  Some  of  these  incidents  were  a  direct  result  of  the  LAHSO  operations.  There  were 
cases  in  which  the  pilot  acknowledged  the  clearance  but  didn’t,  or  wasn’t  able  to,  comply.  There 
was  a  case  in  which  the  controller  thought  he  had  issued  the  hold  short  clearance  and  even  wrote 
in  on  the  strip,  but  in  actuality  had  not  issued  it.  There  were  other  incidents  in  which  LAHSO 
were  indirectly  involved;  while  the  controller’s  attention  was  focused  on  ensuring  that  the 
aircraft  held  as  instructed,  there  was  an  incident  elsewhere.  Whether  or  not  LAHSO  were  in 
effect  at  the  time  of  an  operational  error  needs  to  be  routinely  recorded  as  part  of  the  effort  to 
assess  the  risk  of  LAHSO  and  how  the  risk  can  be  mitigated.  It  may  be  the  case  that  the  extra 
attention  which  LAHSO  require  necessitate  additional  support  of  some  sort. 

5.2.5.3  Combined  Positions  -  Ten  percent  of  the  reports  of  operational  errors  and  deviations 
specified  that  the  controller  was  working  combined  positions  at  the  time  of  the  incident.  Some 
of  these  reports  specifically  mention  that  this  was  a  contributing  factor  to  the  complexity  of  the 
traffic,  others  do  not.  The  reports  routinely  record  whether  there  were  combined  positions  at  the 
time  of  the  incident;  60  percent  of  the  reports  stated  that  this  was  the  case.  However,  the  reports 
do  not  consistently  state  whether  this  combination  was  normal  for  the  time  of  day  and  traffic 
level,  or  whether  the  combination  of  positions  was  a  contributing  factor  to  the  incident.  Whether 
particular  combinations  of  positions  make  the  operation  more  complex  or  simplifies  things  (e.g., 
because  the  controller  does  not  have  to  coordinate  with  another  position)  depends  on  many 
factors.  However,  it  is  clear  that  the  conditions  under  which  combined  positions  may  contribute 
to,  or  protect  from,  operational  errors  merit  further  study. 

5.2.5A  Situation  Awareness  Upon  Assuming  a  Position  -  ‘Time  on  position,”  that  is,  how 
long  the  controller(s)  was  on  position  before  the  incident  occurred,  is  routinely  recorded.  It  was 
an  interesting  finding  that  20  percent  of  the  operational  errors  and  deviations  occurred  in  first  10 
minutes  on  position.  While  this  may  suggest  that  an  inadequate  position  relief  briefing  may  be 
partly  responsible,  this  factor  was  cited  in  only  four  percent  of  the  reports.  Further  study  is 
required  to  determine  if  this  finding  of  a  “vulnerability”  to  operational  errors  in  the  first  10 
minutes  of  assuming  a  position  is  a  stable  one.  Also,  correlating  the  time  on  position  with  the 
type  of  error  may  help  point  to  specific  remedies.  Meanwhile,  controllers  should  be  aware  that 
the  first  ten  minutes  on  position  is  a  particularly  vulnerable  time. 

5.2.5.S  Intersection  Take-Offs  -  While  intersection  take-offs  were  cited  in  some  of  the  reports 
of  operational  errors  and  deviations,  it  is  not  a  factor  that  is  automatically  coded.  In  more  than 
one  instance,  the  controller  assumed  that  the  pilot  would  taxi  to  the  departure  end  of  the  runway 
when  in  fact  the  pilot  taxied  to  the  intersection.  The  risks  associated  with  intersection  takeoffs, 
and  the  potential  benefits  of  mnway  status  lights  or  other  tools  need  to  be  determined. 

5.2.6  Operational  Errors  and  Deviations  —  What  do  they  tell  us  about  what  can  be  done? 

While  the  reports  of  operational  errors  and  deviations  detail  the  aftermath  of  the  incident  as  far  as 
the  controller  involved  is  concerned  (training,  scheduled  performance  checks,  videos,  etc.),  they 
do  not  necessarily  contain  recommendations  for  remedies  for  the  type  of  error  that  occurred. 
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Occasionally,  however,  the  operational  error  or  deviation  report  does  specify  a  potential  remedy 
to  the  incident  reported.  For  example,  one  report  recommended  that  the  facility  “aggressively 
pursue  the  acquisition  of  AMASS  and  perimeter  taxiways”  since  “the  redundancy  provided  by 
the  installation  of  AMASS  may  have  prevented  this  surface  error.  In  addition,  it  was  determined 
if  perimeter  taxiways  were  built  and  used,  this  too  would  have  prevented  the  occurrence.”  Since 
such  specific  recommendations  were  not  usually  contained  in  the  reports,  the  circumstances  of 
the  error  were  examined  for  indications  as  to  what  tools  -  such  as  memory  aids  surveillance 
and/or  monitoring  systems  (conceptually  similar  to  AMASS)  -  could  have  been  helpful  in 
preventing,  or  mitigating  the  consequences  of,  these  errors. 

5.2.6.1  Aids  to  Controller  Memory  -  Memory  aids,  or  better  memory  aids,  were  considered  as 
a  potential  remedy  in  nine  percent  of  the  errors  and  deviations.  Of  course,  memory  aids  only 
have  a  chance  at  being  effective  if  they  are  used  (in  some  cases  they  were  available,  but  not 
used),  and  no  common  type  of  memory  aid  (e.g.,  placards)  is  infallible.  Nonetheless,  they  are  a 
simple  and  cost-effective  countermeasure.  Some  memory  aids  are  better  than  others.  While 
effective  memory  aids  and  other  tools  are  often  invented  at  individual  towers,  a  mechanism  is 
needed  for  towers  to  share  these  potential  remedies  and  to  study  their  effectiveness.  The  generic 
sounding  “runway  incursion  device”  (RID)  means  different  things  to  different  controllers;  an 
illuminated  airport  diagram  that  indicates  active  runways  is  one  example  of  such  a  memory  aid. 

5.2.6.2  Better  Surveillance  and  Monitoring  Equipment  -  A  surveillance  and  monitoring 
system  that  contains  alerting  algorithms  to  indicate  to  the  controller  that  an  aircraft  was  on 
approach  to  a  runway  that  was  not  clear  (i.e.,  occupied  with  part  or  all  of  an  airplane,  occupied 
by  a  vehicle,  or  is  closed)  would  be  very  useful  (assuming  that  the  false  alarm  rate  was 
acceptably  low  and  the  alerts  were  timely).  Many  of  the  errors  and  deviations  involved 
situations  in  which  the  error  developed  so  quickly  that  no  such  warning  system  would  have  been 
effective.  However,  such  a  system  was  judged  to  have  been  potentially  useful  in  51  percent  of 
the  incidents  examined.  That  is,  51  percent  of  the  operational  errors  and  deviations  involved 
situations  in  which  currently  proposed  functionality  -  runway  status  lights,  AMASS,  loops,  etc.  - 
are  expected  to  be  effective  countermeasures.  Runway  status  lights  at  runway  intersections  that 
automatically  tum  red  when  an  aircraft  is  on  final  approach  to  that  runway  has  received 
anecdotal  approval  from  both  pilots  and  controllers.  However,  it  is  clear  that  the  lights  need  to 
be  capable  of  displaying  more  than  “red”  or  “off;”  another  color  (such  as  yellow)  needs  to  be 
displayed  to  indicate  to  the  pilot  that  the  system  is  working  even  when  red  is  not  displayed. 

5.2.6.3  Communication  and  Coordination  -  Voice  communication  between  pilots  and 
controllers  is  a  critical  safety  link  in  airport  operations.  The  results  of  the  independent  analysis 
showed  that  miscommunications  between  controllers  and  pilots  were  a  contributing  factor  in 
almost  20  percent  of  the  operational  errors  examined.  Previous  studies  of  ground  and  local 
control  operations  have  shown  that  less  than  1  percent  of  controller-pilot  communications  result 
in  a  readback  error  and  at  least  half  of  these  readback  errors  are  corrected  by  the  controller 
(Burki-Cohen,  1995;  Cardosi,  1994).  While  not  all  clearances  are  read  back,  the  pilot’s  readback 
is  the  controller’s  only  opportunity  to  catch  a  misunderstanding  before  it  results  in  an  incursion; 
pilots  should  read  back  critical  information  (e.g.,  call  sign,  runway  number,  hold  short).  The 
readback  and  hearback  error  rates  demonstrate  that  pilots’  and  controllers’  performance  in  this 
area  are  better  than  can  reasonably  be  expected.  It  is  possible  to  conceive  of  a  voice  recognition 
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system  that  codes  the  clearance  as  it  is  spoken  by  the  controller,  checks  for  pilot  readback  errors, 
monitors  for  conflicting  clearances  issued  to  different  aircraft,  and  monitors  the  flight  path  and 
taxi  routes  for  potential  deviations  from  the  clearance.  While  such  a  system  would  be  very 
useful,  it  is  far  from  being  developed. 

Coordination  among  controllers  in  the  tower  is  necessary  for  efficient  and  safe  operations.  Poor 
coordination  was  noted  as  a  contributing  factor  in  tower  operational  errors  in  18  percent  of  the 
reports  in  the  independent  analysis  (and  even  more  in  the  FAA  analysis).  There  is  an  effort 
underway  to  enhance  coordination  among  controllers;  this  training,  called  Air  Traffic  Teamwork 
Enhancement  (ATTE)  is  one  mechanism  that  has  the  potential  to  enhance  the  effectiveness  of 
tower  controller  coordination. 

5.2.6.4  Staffing  -  Safe  operations  require  adequate  staffing  for  the  number  and  complexity  of 
the  operations.  Sufficient  staffing  implies  the  presence  of  a  supervisor  or  controller-in-charge 
(CIC).  When  supervisors  also  work  a  control  position,  however,  they  are  not  afforded  the 
opportunity  to  devote  their  full  attention  to  the  “big  picture.”  The  value  of  an  “extra  set  of  eyes 
and  ears”  cannot  be  underestimated  for  catching  errors  before  they  escalate. 

Airport  Specific  Analysis  —  Studies  of  individual  airport  operations  and  errors  to  determine 
what  can  be  done  to  prevent  accidents  and  incidents  are  very  valuable,  as  are  the  insights  of  the 
operations  specialists  at  that  facility.  Recall  that  one  report  (Skaliotis,  1991)  identified  that  it  is 
airport  specific  factors  and  the  number  of  runway  incursions  (rather  than  the  rate)  that  is  most 
predictive  of  future  problems.  While  it  is  beyond  the  scope  of  this  report  to  make  airport- 
specific  recommendations,  such  analyses  are  a  critical  step  toward  finding  effective  solutions. 

For  example,  Los  Angeles  tower  has  analyzed  their  runway  incursions  and  identified  areas  on  the 
airport  surface  that  are  particularly  problematic.  Furthermore,  they  were  able  to  determine  that 
building  an  additional  taxiway  could  help  to  alleviate  the  problem.  While  it  is  beyond  the  scope 
of  this  report  to  make  airport-specific  recommendations,  such  analyses  are  a  critical  step  toward 
finding  effective  solutions.  Los  Angeles  tower  has  analyzed  their  runway  incursions  and 
identified  areas  on  the  airport  surface  that  are  particularly  problematic.  Furthermore,  they  were 
able  to  determine  that  building  an  additional  taxiway  would  help  to  alleviate  the  problem.  Often, 
there  is  a  pattern  to  operational  errors.  Identifying  the  pattern  of  errors  can  help  point  to 
solutions.  For  example,  the  following  is  an  excerpt  from  an  operational  error  report: 

‘Three  of  the  four  operational  errors/deviations  that  have  occurred  in  this  facility 
on  the  past  12  months  were  readback/hearback  errors.  All  four  involved  an  ATCS 
[air  traffic  control  specialist]  working  combined  local  control  positions  where 
arrivals  and  departures  were  segregated  on  separate  runways.  Indeed,  75  percent 
of  all  operational  errors/deviations  since  February  1995  have  occurred  in  this 
configuration.  This  scenario  necessitates  a  field  of  vision  of  140  degrees  or  more 
to  accommodate  all  operations.  (Decombined  positions  require  a  field  of  vision 
of  no  more  than  90  degrees.)... I  recommend  that,  staffing  permitting,  either  the 
CC,  OSIC,  or  a  local  assist  be  mandated  to  actively  monitor  (via  the  ICSS)  any 
combined  local  control  position  where  arrivals  and  departures  are  segregated  on 
separate  runways  or  the  positions  be  decombined.” 
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5.3  REPORTS  SUBMITTED  TO  THE  AVIATION  SAFETY  REPORTING  SYSTEM 


The  Aviation  Safety  Reporting  System  is  a  wealth  of  information  submitted  by  pilots  and 
controllers  regarding  specific  events  and  concerns.  Self  -reports  of  errors  typically  present  a 
candid  portrayal  of  causal  factors  that  the  person  may  or  may  not  wish  to  relay  to  the 
investigative  authority.  In  an  effort  to  determine  the  causal  factors  of  tower  controller  errors 
(and  potential  solutions)  as  well  as  the  general  concerns  of  tower  controllers,  the  most  recent  300 
ASRS  reports  submitted  by  tower  controllers  were  examined.  Of  these,  some  were  duplicates 
and  others  did  not  contain  enough  information  to  merit  analysis.  This  left  249  reports  on  which 
the  following  results  are  based.  The  results  of  this  analysis  are  presented  in  Table  1  -  Results  of 
Analysis  of  Controller  ASRS  Reports.  Note:  While  some  reports  listed  multiple  contributing 
factors,  others  did  not  describe  any.  Thus,  there  is  not  a  1:1  correspondence  between  errors  and 
contributing  factors. 


Table  1.  Results  of  Analysis  of  ASRS  Reports  Submitted  by  Tower  Controllers  (N  =  249) 


Pilot  Deviated  from,  or  Proceeded  Without,  Clearance  -  Air 

•  23  -  Heading/altitude 

•  5  -  Entered  airspace  without  authorization 

Resulting  in 

•  16  -  Near  Mid  Air  Collision  (NMAC) 

•  12  -  Potential  conflict/other 

•  22  -  Would  have  benefited  from  improved  surveillance  and  monitoring  equipment 

o  6  -specifically  mention  the  need  for  radar  at  that  facility 

28 

Pilot  Deviated  from,  or  Proceeded  Without,  Clearance  -  Ground 

•  21  -  Runway  incursions 

•  6  -  Surface  incidents 

27 

Vehicles  Proceeded  onto  Runway  Without  Authorization 
•  3  -  Runway  Incursions 

3 

No  incident/Controller  Reports  of  Pilot  Error/Other 

•  16  -  Didn’t  proceed  as  instructed 

•  1  -  Landed  without  a  clearance 

•  3  -  Penetrated  airspace  without  authorization 

•  2  -  Pilot  error  in  judgment 

•  8  -  Other  incidents  (e.g.,  mechanical  problem,  ran  out  of  fuel,  bird  strike) 

30 

36 


Table  1.  Results  of  Analysis  of  ASRS  Submitted  by  Tower  Controllers  (N  =  249)  (Cont.) 


No  Incident/Controller  Concerns  Regarding 

•  Problems  with  equipment 

o  17  -  Radar  outages/malfunction 
o  2  -  Want  radar 
o  13  -  Communication  equipment 
o  3  -  Other  equipment  concerns 
o  21 -Weather  equipment 

■  5  -  Need  wind  information 

■  5  -  Need  LLWS  indication 

■  1 1  -  Problems  with  ASOS 

•  13  -  Local  procedures,  problem  traffic  (e.g.,  military,  student  pilots) 

•  7  -  Letters  of  Agreement  (LOA) 

•  3  -  “Unnecessary”  TCAS  RA’s 

•  3  -  Need  indication  of  approach  lights  inoperative 

j  •  5  - LAHSO 

87 

Controller  ‘Forgot’ 

•  8  -  Aircraft  cleared  to  land 

•  4  -  Runway  was  closed 

•  4  -  Vehicle  on  runway 

•  4  -  Aircraft  holding  in  position 

•  1  -  Aircraft  cleared  for  takeoff 

•  1  -  Aircraft  on  approach 

Results 

•  18  -  Runway  Incursions 

•  2  -  Aircraft  taxied  to  closed  runways 

•  2  -  Aircraft  landed  on  closed  runways 

Contributing  factors  mentioned  by  respondents 

•  7  -  Combined  positions 

•  3  -  Fatigue 

•  2  -  Workload 

•  1  -  Poor  position  relief  briefing 

•  1  -  Distraction  caused  by  visitors 

•  1  -  Exhaust  fumes  in  tower 

22 

Didn’t  Know  About,  or  Didn’t  Know  Location  of.  Aircraft 

H 
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Table  1.  Results  of  Analysis  of  ASRS  Submitted  by  Tower  Controllers  (N  =  249)  (Cont.) 


Poor  Controller-Controller  Coordination 
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Results 

•  2  -  Runway  Incursions 

•  6-NMAC 

•  10  -  Loss  or  potential  loss  of  separation 

Contributing  factors 

•  4  -  Poor  position  relief  briefing 

•  1  -  Combined  positions 


Controller  Error  in  Projecting  Separation  -  Air 
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Results 

•  1-NMAC 

•  13  -  Loss  of  separation 

o  4  -  Combined  positions 

Controller  Error  in  Projecting  Separation  -  Ground  10 

Results 

•  9  -  Runway  incursions 

•  1  -  Loss  of  separation 

Controller  Misidentified/Issued  Clearance  to  Wrong  Aircraft  6 

•  1  -NMAC 

•  5  -  Loss  of  separation 


5.3.1  Reports  Submitted  by  Tower  Controllers 


5.3.1.1  Controller  Concerns  -  Of  the  249  reports  submitted  by  tower  controllers,  87  (35 
percent)  did  not  contain  reports  of  surface  incidents,  but  rather  described  issues  of  concern  to 
controllers.  The  majority  (64  percent))  of  these  reports  described  problems  with,  or  other 
concerns  about,  equipment.  Of  the  reports  concerning  equipment  38  percent  of  these  reports 
concerned  weather  information:  ASOS  (Automated  Surface  Observation  System)  inaccuracies, 
the  need  for  wind  information  or  the  need  for  low-level  wind  shear  indication.  An  additional  34 
percent  of  these  reports  were  regarding  radar  outages,  malfunction,  or  cited  the  need  for  radar  at 
that  facility.  Twenty-three  percent  of  the  controller  concerns  were  regarding  local  procedures, 
local  “problem  traffic”  (such  as  training  centers  or  high  speed  military  traffic)  and  reports  of 
problems  with  local  letters  of  agreement  (LOAs)  or  reports  of  controllers  at  other  facilities 
failing  to  comply  with  LOAs.  The  remaining  controller  concerns  contained  in  these  reports 
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concerned  LAHSO  (land  and  hold  short  operations),  and  miscellaneous  issues  (such  as  air 
quality  in  the  tower)  each  comprising  less  than  four  percent  of  the  reports  of  controller  concerns. 

5.3.1.2  Controller  Reports  of  Pilot  Errors  -  Thirty-two  percent  of  the  reports  submitted  by 
tower  controllers  describe  pilot  error  and  other  incidents  unrelated  to  controller  errors  or 
concerns.  One-third  of  these  reports  were  non-specific  and  did  not  describe  surface  incidents  or 
potential  loss  of  standard  separation.  The  remaining  55  reports  described  incidents  in  which 
pilots  deviated  from,  or  proceeded  without,  a  clearance  in  the  air  (28  reports)  or  on  the  ground 
(27  reports). 

Of  the  28  incidents  in  which  pilots  deviated  from  their  clearance  in  the  air: 

•  82%  involved  pilots  deviating  from  their  assigned  heading  or  altitude. 

•  16%  involved  pilots  entering  controlled  airspace  without  authorization. 

•  57%  of  them  resulted  in  Near  Mid-Air  Collisions  (NMAC). 

•  78%  of  them  were  judged  to  be  situations  that  would  have  benefited  from  better 
surveillance  and  monitoring  equipment;  in  fact,  in  21  percent  of  these  reports,  the 
reporter  specifically  mentions  that  if  they  had  radar  at  the  facility,  the  controller  would 
have  been  able  to  detect  the  problem  much  earlier. 

Of  the  27  incidents  in  which  pilots  deviated  from  their  clearance  on  the  ground: 

•  78%  resulted  in  runway  incursions. 

•  22%  resulted  in  surface  incidents. 

•  11%  occurred  because  the  pilot  was  lost. 

•  7 1  %  cited  the  need  for  better  airport  markings. 

•  82%  of  these  reports  did  not  offer  insights  as  to  why  the  event  occurred. 

5.3.13  Controller  Errors  -  Self-Reports  -  Perhaps  the  most  informative  reports  submitted  by 
controllers  are  those  that  describe  errors  that  they  themselves  committed.  There  were  74  (30 
percent)  such  reports  in  the  249  reports  examined.  In  general,  these  reports  show  similar  trends 
as  the  operational  error  data.  The  errors  fall  into  three  distinct  categories:  memory  lapses, 
controller-controller  coordination,  and  judgment  errors  in  predicting  separation. 

The  most  common  type  of  error  reported  involved  memory  lapses.  Instances  in  which  the 
controller  forgot  about  an  aircraft,  that  a  runway  was  closed,  or  that  a  clearance  had  been  issued 
accounted  for  29  percent  of  the  76  self-reports  of  controller  errors.  Eighty-two  percent  of  these 
errors  resulting  from  memory  lapses  resulted  in  runway  incursions.  Additionally,  two  aircraft 
were  cleared  to  land  on  a  closed  runway.  While  not  all  respondents  reported  factors  that 
contributed  to  these  errors,  the  most  common  contributing  factor  reported  was  that  the  controller 
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was  working  combined  positions;  this  was  cited  in  32  percent  of  the  errors  involving  memory 
lapses. 

There  were  24  reports  involving  instances  in  which  the  controller  made  a  judgment  error  in 
predicting  separation.  Fourteen  of  these  involved  separation  in  the  air;  13  of  these  errors  resulted 
in  a  loss  of  standard  separation  and  one  resulted  in  a  NMAC.  Four  of  these  reports  specified  that 
the  controller  was  working  combined  position  at  the  time  of  the  incident.  An  additional  10 
reports  of  controller  judgment  errors  involved  separation  on  the  ground  (nine  resulting  in  runway 
incursions);  none  of  these  reported  that  the  controller  was  working  combined  positions  at  the 
time  of  the  incident. 

Twenty-four  percent  of  the  controller  errors  involved  poor  coordination  between  controllers. 
Thirty-three  percent  (6)  of  these  instances  resulted  in  NMACs,  and  7  percent  resulted  in  runway 
incursions  (the  remainder  resulted  in  a  loss  or  possible  loss  of  standard  separation).  In  four  of 
these  cases,  the  reporter  cited  a  poor  position  relief  briefing  as  a  primary  cause  (e.g.,  the 
controller  was  not  informed  of  an  aircraft);  in  one  case  the  controller  was  working  combined 
positions. 

In  summary,  the  self-reports  of  controller  errors  fell  into  three  distinct  categories:  memory 
lapses,  failure  in  judging  or  predicting  separation,  and  inadequate  controller-controller 
coordination.  Although  most  of  these  reports  did  not  identify  causal  factors,  16  percent  stated 
that  the  controller  was  working  combined  positions  at  the  time,  6  percent  identified  a  poor 
position  relief  briefing  as  contributing  to  the  error,  4  percent  identify  fatigue  as  a  contributing 
factor,  and  4  percent  mentioned  controller-pilot  communication  errors  (one  report  involving  a 
blocked  communication). 

5.3.2  Reports  Submitted  by  Pilots 

The  100  most  recent  ASRS  reports  of  runway  transgressions  submitted  by  pilots  were  examined. 
“Runway  transgression”  was  defined  by  ASRS  as  the  “erroneous  or  improper  occupation  of  a 
runway  or  its  immediate  environs  by  an  aircraft  or  other  vehicle  so  as  to  pose  a  potential 
collision  hazard  to  other  aircraft  using  the  runway,  even  if  no  such  aircraft  were  actually 
present.”  However,  the  present  analysis  uses  the  terms  “runway  incursions”  and  “surface 
incidents”  as  defined  on  page  1.  Nineteen  reports  were  excluded  from  further  analysis  for  one  of 
the  following  reasons: 

•  The  event  occurred  at  an  uncontrolled  field,  when  the  tower  was  closed  or  at  a  foreign 
airport. 

•  The  event  was  unrelated  to  pilot  error  (i.e.,  due  to  an  airplane  equipment  failure  or 
controller  error). 

•  The  report  was  of  a  safety  concern  peculiar  to  that  airport. 

An  additional  five  reports  did  not  fit  into  any  category  for  analysis.  They  described  incidents  in 
which:  a  student  pilot  took-off  without  a  clearance  resulting  in  a  NMAC  with  a  larger  aircraft;  a 
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Cessna  entered  controlled  airspace  without  a  clearance,  resulting  in  a  NMAC  with  a  departing 
aircraft;  a  pilot  who  was  cleared  for  an  intersection  take-off,  but  took-off  in  the  wrong  direction; 
a  pilot  who  landed  at  the  wrong  airport;  and  a  pilot  who  aborted  a  take-off  after  seeing  another 
aircraft  on  the  runway  (but  the  report  lacked  sufficient  detail  for  the  nature  of  the  error  to  be 
identified). 

The  results  of  the  remaining  76  incidents  are  shown  in  Table  2.  As  with  the  reports  submitted  by 
controllers,  some  reports  listed  multiple  contributing  factors  while  others  did  not  list  any.  Thus, 
there  is  not  a  1 : 1  correspondence  between  errors  and  contributing  factors.  The  same  trends  were 
found  in  these  data  as  in  the  earlier  survey  of  airline  pilots  conducted  by  MITRE  (Adam,  et  al., 
1994).  Thirty-seven  (49  percent)  of  the  reports  involved  aircraft  crossing  the  “hold  short”  line. 
These  instances  resulted  in  12  runway  incursions  (six  aborted  take-offs  and  six  “go-arounds”). 
Most  (67  percent)  of  these  errors  were  attributed  to  the  pilot  not  being  able  to  see  the  hold  short 
line  or  otherwise  poor  markings.  Thirty  six  percent  of  the  76  reports  involved  pilots  taxiing  onto, 
or  crossing,  the  runway  without  authorization.  These  incidents  resulted  in  22  surface  incidents 
and  five  runway  incursions.  Where  a  causal  factor  was  mentioned,  the  report  cited  a 
communication  error  between  controller  and  pilot  or  the  need  for  better  airport  markings.  In 
summary,  the  76  incidents  reported  by  pilots  resulted  in  19  runway  incursions  and  57  other 
surface  incidents.  Fifty-one  percent  of  these  76  reports  cited  the  need  for  better  airport  markings 
and  35  percent  were  attributable  to  controller-pilot  communication  errors  (36  percent  of  these 
communication  errors  involved  aircraft  accepting  another  aircraft’s  clearance). 

5.3.3  Pilot  and  Controller  Errors  Reported  to  ASRS  -  What  can  be  done  to  prevent 
runway  incursions? 


The  tower  “shortfalls”  that  the  analysis  of  ASRS  reports  points  to  are  the  need  to  prevent,  and 
mitigate  the  consequences  of,  errors  due  to:  failures  of  controller  memory,  miscommunications 
between  pilots  and  controllers,  failures  of  coordination  among  controllers,  failure  of  controllers 
to  accurately  project  separation  between  aircraft.  The  reports  from  the  controllers  and  pilots 
support  the  recommendations  gleaned  from  the  literature  review: 

•  Improve  surveillance  and  monitoring  equipment  for  controllers. 

•  Improve  means  of  communication  between  pilots  and  controllers. 

•  Improve  airport  markings  and  signage  -  particularly  more  conspicuous  “hold  short” 
markings. 

The  reports  from  controllers  also  point  to  the  need  for  improved  coordination  among  tower 
controllers  and  the  need  for  controllers  to  verify  that  the  runway  is  clear  before  allowing  an 
aircraft  to  take-off  or  land.  This  task  could  be  aided  by  a  system  (for  pilots  and/or  controllers) 
that  displays  whether  or  not  the  runway  is  occupied. 

Reports  from  pilots  also  point  to  the  need  for  cockpit  standard  operating  procedures  (SOPs)  for 
ground  operations.  Such  SOPs  would  help  to  ensure  that: 
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Table  2.  Pilot  Reports  of  “Runway  Transgression”  Incidents  (N  =  76) 

Failure  to  “hold  short”  as  instructed/crossed  “hold  short”  line 
Results 

•  2  runway  incursions 

•  25  surface  incidents 

Contributing  factors 

•  25  couldn’t  see  the  hold  short  line  or  thought  the  marking  was  poor  (includes  3 
obscured  by  snow) 

•  7  miscommunication/misunderstood  the  clearance 

•  1  was  confused  as  to  where  to  hold 

•  1  cockpit  distraction 

•  1  accepted  “LAHSO”  clearance  and  then  forgot  to  hold  short 

•  1  instruction  to  hold  short  was  issued  to  late  for  pilot  to  comply 

•  2  poor  crew  coordination  (one  pilot  knew  the  clearance,  the  other  didn’t) 

Taxied  to  (includes  one  aircraft  that  took-off  from)  wrong  runway 
Results 

•  8  surface  incidents 

•  Contributing  factors 

•  2  need  better  airport  markings 

•  5  controller-pilot  miscommunication/misunderstood  the  clearance 
Taxied  onto,  or  crossed,  the  runway  without  authorization 

Results 

•  22  surface  incidents 

•  5  runway  incursions 

Contributing  factors 

•  11  controller-pilot  miscommunication/misunderstood  the  clearance  (includes  4 
incidents  in  which  aircraft  accepted  a  clearance  intended  for  another  aircraft  with 
similar  call  sign) 

•  12  cited  need  for  better  airport  markings  (one  obscured  by  snow) 


Table  2.  Pilot  Reports  of  “Runway  Transgression”  Incidents  (N  =  76)  (Cont.) 


Took  off  without  authorization 

Results 

•  2  surface  incidents 

•  4  runway  incursions 

Contributing  factors 

•  4  controller-pilot  miscommunication/misunderstood  the  clearance 

4 

Summary  data 

•  76  incidents  (19  runway  incursions  57  surface  incidents) 

•  39  were  attributed  to  poor  airport  markings/signage 

•  27  involved  miscommunications  (including  5  instances  in  which  an  aircraft 
accepted  a  clearance  intended  for  another  aircraft  with  a  similar  call  sign) 

•  Non-essential  tasks  are  completed  during  relatively  low  workload  and  non-critical  phases 
of  operation. 

•  Pilots  are  aware  of  the  location  of  their  aircraft  on  the  airport  surface,  the  location  of  all 
critical  elements  in  the  airport  environment  (e.g.,  hold  short  points,  intersecting  runways, 
aircraft  on  approach)  and  their  ATC  clearance. 

5.4  FINAL  REPORTS  OF  AVIATION  ACCIDENTS  AND  INCIDENTS 

INVESTIGATED  BY  THE  NATIONAL  TRANSPORTATION  SAFETY  BOARD 
(NTSB) 

As  of  November  15, 1999,  there  were  42  final  reports  in  the  NASD  AC  data  base  of  accidents 
and  incidents  in  airspace  controlled  by  air  traffic  control  towers.  These  reports  covered  the 
period  of  December  1983  to  July  1995.  Eighteen  of  these  reports  were  excluded  from  further 
human  factors  analysis  for  the  following  reasons.  Seven  were  duplicate  reports  of  the  same 
accident  or  incident,  since  one  report  is  filed  for  each  aircraft  involved;  these  reports  were 
excluded  so  that  each  accident/incident  would  be  represented  only  once.  Four  were  reports  of 
aircraft  mechanical  failure.  Two  reports  involved  non-movement  ramp  areas  (i.e.,  not  controlled 
by  the  tower).  One  report  was  of  an  aircraft  landing  at  the  wrong  airport.  One  report  was  of  a 
hard  landing  due  to  extreme  weather.  Another  report  involved  an  aircraft  that  hit  a  localized 
after  flying  through  windshear.  One  report  involved  a  “bird  strike,”  and  another  involved  a  pilot 
becoming  incapacitated.  The  remaining  24  reports  -  six  accidents  and  18  incidents  -  were 
analyzed  for  causal  factors  and  potential  remedies.  Two  of  these  incidents  consisted  of  loss  of 
standard  separation  between  two  take-offs  as  a  result  of  controller  error  in  anticipating 
separation;  they  did  not  result  in  NMACs  or  surface  incidents. 
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Of  the  22  accidents  and  incidents,  the  results  were  formally  classified  as: 

•  8  “near  collisions  between  aircraft.” 

•  1  “collision  between  aircraft.” 

•  7  “collisions  with  object.” 

The  remaining  six  incidents  were  runway  incursions.  Of  the  seven  “collisions  with  objects,”  six 
of  the  “objects”  that  aircraft  collided  with  were  other  (stationary)  aircraft  and  one  was  a  snow 
sweeper. 

Of  these  22  accidents  and  incidents,  by  far  the  largest  common  factor,  occurring  in  70  percent  of 
these  reports,  was  the  failure  to  verify  that  the  runway  was  clear  before  allowing  an  aircraft  to 
takeoff  or  land.  In  three  of  these  cases,  the  pilots  reported  that  their  aircraft  were  clear  of  the 
runway,  when  in  fact  it  was  not;  in  one  case,  a  fleet  of  vehicles  reported  clear  when  they  were 
not.  Five  (22  percent)  involved  miscommunications  between  pilots  and  controllers;  in  three  of 
these  cases  an  aircraft  accepted  a  clearance  intended  for  another  aircraft.  Another  three  cases  (13 
percent),  involved  a  “memory  lapse”  on  the  part  of  the  controller;  (one  instance  each  of  the 
controller  forgetting  that  he/she  had  cleared  an  aircraft  to  land,  takeoff,  and  position  and  hold  on 
the  runway).  Only  one  case  involved  a  controller  that  was  working  combined  position.  Only 
one  report  mentioned  that  the  supervisor  was  working  a  control  position.  Two  of  the  reports  cite 
poor  airport  markings  (in  one  of  these  cases  a  sign  had  blown  over). 

Visibility  also  appears  to  be  more  of  a  factor  in  these  accidents  than  in  incidents.  Of  the  six 
accidents,  only  one  occurred  in  VMC  conditions  during  the  day.  Two  occurred  in  EMC  during 
the  day.  Two  occurred  in  VMC  at  night  (this  includes  one  with  some  fog).  One  accident 
occurred  in  VMC  at  dusk.  Of  the  16  incidents,  8  occurred  in  VMC  during  the  day  (this  includes 
one  with  haze  and  another  with  rain  and  haze).  Five  occurred  during  VMC  at  night  (one  with 
haze  and  one  with  snow).  Two  incidents  occurred  during  EMC  at  night  and  one  occurred  during 
IMC  during  the  day. 

5.4.1  NTSB  Final  Reports  of  Accidents  and  Incidents  -  What  do  they  tell  us  about  what 
can  be  done? 


The  NTSB  compiles  recommendations  to  the  FAA  (to  which  the  FAA  must  respond  in  a  timely 
manner).  All  of  the  NTSB  recommendations  to  the  FAA  concerning  tower  airspace  were 
reviewed  for  tower  shortfalls.  The  recommendations  cover  a  wide  range  of  topics  unrelated  to 
tower  shortfalls.  Among  them  were  recommendations  regarding:  procedures,  staffing,  training, 
traffic  restrictions,  pilot  training,  training  for  airport  vehicle  drivers,  controller  phraseology, 
controller-pilot  communications,  airport  markings,  runway  lighting,  and  aircraft  conspicuity. 
The  recommendations  that  target  tower  “shortfalls”  address  the  need  for  improved  surveillance 
and  monitoring  systems  and  specifically  mention  -  AMASS  and  ASDE-3. 

5.4.1.1  AMASS  -  In  recommendation  A-91-29,  the  NTSB  recommended  that  the  FAA, 
“Expedite  efforts  to  fund  the  development  and  implementation  of  an  operational  system 
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analogous  to  the  airborne  conflict  alerts  system  to  alert  controllers  to  pending  runway  incursions 
at  all  terminal  facilities  that  are  scheduled  to  receive  ASDE-3.”  Later,  the  NTSB  recommended, 

“For  these  air  traffic  control  facilities  with  operational  ASDE-  3  systems  to  operate  that 
equipment  between  sunset  and  sunrise,  regardless  of  weather  or  visibility.  Current 
operational  requirements  for  the  AMASS  specify  that  the  system  be  capable  of  240  hour 
a  day  operation.  Before  the  first  AMASS  is  commissioned,  require  by  order  that  the 
AMASS/ASDE  3  be  operational  24  hours  a  day”  (A-95-32). 

Most  recently,  a  letter  from  the  NTSB  dated  March  10, 2000  states:  “The  Safety  Board 
considers  airport  runway  incursions  an  extremely  serious  safety  problem.  This  safety  issue  has 
been  on  our  Most  Wanted  Transportation  Safety  Improvements  list  since  the  list’s  creation  in 
September  1990.  The  Safety  Board  is  disappointed  that  4  lA  years  have  passed  since  A-95-32 
was  issued  requesting  expeditious  action,  during  which  time  the  FAA  has  not  completed  the 
work  necessary  to  meet  the  intent  of  these  recommendations.  Because  the  number  of  near 
runway  incursions  has  increased  over  the  last  few  years,  the  problem  needs  to  be  solved 
immediately.  Therefore,  the  board  reclassifies  Safety  Recommendation  A-95-32  and  A-91-29 
“Open  -  Unacceptable  Response,”  pending  immediate  action  to  meet  these  recommendations. 

5.4.1.2  ASDE  -  The  first  recommendation  concerning  ASDE  was  for  the  FAA  to,  “Conduct 
research  and  development  efforts  to  provide  airports  that  are  not  scheduled  to  receive  Airport 
Surface  Detection  Equipment  with  an  alternate  cost  effective  system  to  bring  controller  and  pilot 
attention  to  pending  runway  incursions  in  time  to  prevent  ground  collisions”  (A-91-30).  Later, 
the  NTSB  recommended  that  the  FAA  “Continue  research  and  development  efforts  to  provide 
airports  that  are  not  scheduled  to  receive  Airport  Surface  Detection  Equipment  with  an  alternate, 
cost-effective  system,  such  as  the  ground  induction  loop,  to  bring  controller  and  pilot  attention  to 
pending  runway  incursions  in  time  to  prevent  ground  collisions”  (A-95-94). 

The  plans  for  testing  and  implementation  of  ASDE-X  and  ground  induction  loops  satisfy  these 
recommendations.  The  FAA’s  plans  for  “runway  status  lights”  were  also  seen  as  supportive  of 
the  intent  of  these  recommendations.  These  lights  would  activate  when  “the  runway  is  “hot” 
based  on  radar  sensing  of  aircraft  on  the  approach  or  aircraft  accelerating  and  decelerating  on  the 
runway.  The  lights  would  be  positioned  at  the  edge  of  the  runway  in  order  to  be  visible  from  the 
cockpit  while  an  aircraft  is  holding  short  of  the  runway.  Additional  lights  would  be  visible  by 
the  pilot  in  an  aircraft  that  is  in  position  and  holding  for  departure.  These  runway  status  lights 
would  operate  independent  of  the  controller  by  acting  as  an  automated  backup  for  the  pilot.” 
(FAA  letter  to  NTSB  dated  August  12, 1991). 

As  was  noted  previously  in  this  report,  the  concept  of  automated  runway  status  lights  has 
received  anecdotal  approval  from  both  pilots  and  controllers.  However,  it  is  clear  that  the  lights 
need  to  be  capable  of  displaying  more  than  “red”  or  “off,”  another  color  (such  as  yellow)  needs 
to  be  displayed  to  indicate  to  the  pilot  that  the  system  is  working  even  when  red  is  not  displayed; 
(otherwise,  the  pilots  are  likely  to  query  the  controller,  resulting  in  a  potentially  unacceptable 
increase  in  voice  communications). 
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5.5  1977  FATAL  RUNWAY  INCURSION  AT  TENERIFE,  CANARY  ISLANDS 


While  not  covered  in  the  NTSB  data  base,  no  discussion  of  accidents  in  the  tower  environment 
would  be  complete  without  reference  to  the  1977  collision  on  the  runway  at  Tenerife  that 
resulted  in  583  fatalities.  In  this  tragic  event: 

‘The  Pam  Am  crew  was  alarmed  by  the  way  in  which  the  Air  Traffic  Clearance  was 
issued.  The  captain...  feared  that...  the  KLM  could  possibly  take  the  ATC  clearance  as  a 
take  off  clearance  and,  immediately  after  the  tower  controller  had  said  ‘Okay’,  and 
pauses  for  almost  two  seconds,  he  and  his  first  officer  jumped  in  to  inform  the  KLM  crew 
that  they  were  still  taxiing  on  the  runway.  The  message  of  the  Pan  Am  crew  coincided 
with  the  message  of  the  tower  controller  who,  at  that  moment,  told  the  KLM  aircraft  to 
wait  for  take-off  clearance.  The  coinciding  transmission  on  the  same  frequency  resulted, 
in  the  KLM  cockpit  only,  in  a  strong  squeal.  Because  of  this,  both  vital  messages  were 
lost  to  the  KLM  crew  resulting  in  the  worst  collision  in  the  history  of  aviation.  Every  day 
there  are  incidents  of  blocked  communication  that  are  less  dramatic,  but  have  the  same 
potential  for  disaster.” 

Extracted  from  the  conclusions  presented  to  the  Netherlands  Board  of  Inquiry  by  the 
Director  General  of  Civil  Aviation. 

As  the  amount  of  air  traffic  and  radio  frequency  congestion  increases,  blocked  and  partially 
blocked  transmission  present  an  increasing  risk  to  aviation  safety.  While  the  incidence  of  such 
events  in  unknown,  the  risk  that  is  imposed  by  even  a  single  event  is  self-evident.  When  the 
controller  is  not  able  to  access  a  frequency  due  to  a  “stuck  mike,”  the  most  fundamental  safety 
net  -  that  provided  by  voice  communications  between  pilots  and  controllers  -  is  gone.  It  is  not 
surprising  that  32  percent  of  the  controllers  from  Level  5  towers  said  that  there  was  a  significant 
risk  of  surface  incidents  associated  with  a  stuck  mike  (Kelly  and  Jacobs,  1998).  Partially 
blocked  transmissions  or  “step-ons”  are  far  more  common;  recall  that  one-half  of  the  respondents 
to  the  controller  survey  (Kelly  and  Jacobs,  1998)  and  56  percent  of  the  controllers  from  Level  5 
facilities  said  that  transmissions  were  stepped  on  “often”.  While  these  events  are  typically  less 
dramatic  than  that  of  a  stuck  mike,  they  also  present  potential  for  disaster  -  as  in  the  sample  cited 
above. 

Anti-blocking  technology  exists  and  has  been  in  use  both  at  the  Bournemouth  ATC  facility  in  the 
United  Kingdom  and  in  commercial  aircraft  for  several  years.  While  NEXCOM  is  proposed  to 
incorporate  anti-blocking  capability,  the  technology  to  be  used  has  not  yet  been  defined. 
Furthermore,  the  implementation  schedule  does  not  project  this  capability  to  be  available  at 
airports  before  the  year  2015. 

5.6  FAA  PILOT  DEVIATIONS  IN  TOWER  AIRSPACE 

The  67  FAA  records  of  pilot  deviations  that  occurred  in  tower  airspace  (as  contained  in  the 
NASDAC  data  base  in  November,  1999)  were  examined.  While  these  reports  do  not  contain 
enough  detail  to  be  able  to  provide  insight  as  to  why  the  events  happened,  they  do  allow  for  a 
descriptive  analysis  of  the  types  of  events  that  were  reported.  Of  the  67  reports,  two  were  too 
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cryptic  to  be  included  in  the  analysis.  Of  the  remaining  65  deviations,  33  (5 1  percent)  involved 
pilots  entering  controlled  airspace  without  authorization.  Fifty-two  percent  of  these  33 
deviations  resulted  in  Near  Mid-Air  Collisions  (NMAC),  6  percent  resulted  in  runway  incursions 
and  the  rest  were  classified  as  “other  -  no  NMAC.”  In  an  additional  20  (31  percent)  of  the  pilot 
deviations,  the  pilot  did  not  follow  an  ATC  instruction.  (There  is  not  enough  information  in  the 
report  to  determine  whether  the  instruction  was  read  back  or  just  acknowledged.)  There  were  3 
instances  in  which  a  pilot  entered/crossed  an  active  runway  without  authorization;  one  resulted  in 
an  NMAC,  one  resulted  in  a  runway  incursion  and  one  resulted  in  “other.”  There  were  three 
instances  in  which  a  pilot  said  that  the  traffic  was  “in  sight,”  but  then  proceeded  to  loose 
separation  with  that  traffic;  two  of  these  incidents  were  classified  as  NMACs.  There  were  two 
instances  in  which  an  aircraft  landed  on  a  taxiway;  one  cited  no  VASI  or  other  clear  runway 
indications.  The  remainder  of  the  deviations  involved  one  instance  of  the  following: 

•  Aircraft  accepted  a  clearance  intended  for  another  aircraft,  resulting  in  a  NMAC. 

•  Aircraft  landed  without  a  clearance. 

•  Aircraft  landed  on  the  wrong  runway. 

•  Aircraft  took-off  on  a  closed  runway  resulting  in  a  NMAC. 

Over  half  of  the  deviations  recorded  in  tower  airspace  consisted  of  aircraft  entering  without 
authorization.  There  were  only  32  (49  percent)  deviations  that  consisted  of  surface  incidents. 
These  reports  do  not  contain  enough  detail  to  merit  further  analysis  or  lend  themselves  to 
recommendations  regarding  the  needs  of  tower  controllers  other  than  the  need  for  the  controller 
to  be  able  to  “see”  or  otherwise  be  alerted  to  traffic  entering  the  airspace  without  authorization. 

5.7  SUMMARY  OF  THE  RESULTS 

In  summary,  the  data  bases  present  converging  evidence.  While  the  failure  to  anticipate  the 
required  separation  or  miscalculation  of  the  impending  separation  is  an  implied  factor,  the  other 
four  of  the  five  factors  that  were  found  to  contribute  significantly  to  tower  controller  errors  in 
METRE’S  earlier  work  (Bales,  Gilligan,  and  King;  (Steinbacher,  1991)  are  more  directly 
supported.  That  is,  the  most  common  controller-related  factors  identified  in  the  surface  incidents 
examined  in  this  study  were  the  same  as  those  identified  in  previous  studies:): 

•  Forgetting  about  an  aircraft,  the  closure  of  a  runway,  a  vehicle  on  the  runway,  and/or  a 
clearance  that  he/she  had  issued. 

•  Communication  errors  -  readback/hearback  errors,  issuing  an  instruction  other  than  the 
one  the  controller  intended  to  issue. 

•  Lack  of,  or  incomplete,  coordination  between  controllers. 

The  fifth  factor  identified  in  the  literature,  the  absence  of  a  supervisor  (who  was  not  working  a 
control  position),  is  supported  by  the  data,  but  further  study  is  necessary  to  determine  the  degree 
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to  which  this  is  a  factor,  since  it  is  not  consistently  coded  in  the  operational  error  and  deviation 
system,  nor  is  it  reliably  mentioned  (one  way  or  the  other)  in  the  ASRS  or  NTSB  reports.  In 
many  cases,  it  was  the  supervisor  (or  controller-in-charge)  that  prevented  a  bad  situation  from 
getting  much  worse.  Many  reporters  lamented  the  need  for  another  “set  of  eyes”  in  the  tower 
cab.  Obviously,  this  is  an  important  issue  that  merits  further  investigation  to  determine  staffing 
needs.  It  also  supports  the  need  for  more  effective  monitoring  aids  in  the  tower.  “Another  set  of 
eyes”  can  be  electronic  as  well  as  human.  While  the  flexibility  and  speed  of  human  judgment  is 
not  able  to  be  duplicated  by  artificial  intelligence,  tools  that  display  traffic  and  alert  the 
controllers  to  potential  problems  can  be  quite  useful  in  preventing  accidents  and  incidents.  This 
is  a  difficult  task  for  automation  to  perform  because  too  many  false  alarms,  or  too  little  time 
allowed  for  the  controller  to  respond  to  an  alarm,  makes  the  system  ineffective.  If  the  system 
“cries  wolf’  too  often,  then  the  controller  will  eventually  ignore  it.  On  the  other  hand,  for  the 
system  to  be  useful,  it  must  be  able  to  warn  the  controller  that  an  action  is  required  with  enough 
time  to  formulate  and  execute  that  action.  Warnings  that  serve  as  little  more  than  an  indication 
as  to  where  to  look  to  witness  an  accident  are  as  useless  as  warnings  that  are  more  often  false 
alarms  than  legitimate  alerts. 

Frequency  congestion,  blocked  communications,  and  similar  call  signs  continue  to  pose  a  threat 
to  safe  operations.  On  the  pilot’s  end,  similar  call  signs  is  the  primary  factor  in  an  aircraft 
accepting  a  clearance  intended  for  another  aircraft.  On  the  controller’s  end,  it  has  been 
associated  with  a  controller  confusing  two  aircraft  and  issuing  a  clearance  to  the  “wrong” 
aircraft.  Expanded  use  of  data  link  for  controller-pilot  communications  will  remedy  some  of 
these  errors.  For  example,  it  will  be  impossible  for  a  pilot  to  accept  a  data  link  clearance  that  has 
been  sent  to  another  aircraft.  While  it  would  still  be  possible  for  the  controller  to  send  a 
clearance  to  one  aircraft  thinking  it  has  been  sent  to  another,  a  well-designed  controller  interface 
would  ensure  that  these  errors  are  easy  to  detect  and  fix. 

Recall  that  the  solutions  offered  by  both  reports  were: 

•  Installation  of  ASDE-3  and  AMASS  (Airport  Movement  Area  Safety  System). 

•  Electronic  flight  strips. 

•  Development  of  a  voice  recognition  system  to  monitor  key  words  in  transmissions  and 
compare  responses  to  detect  errors. 

•  Development  of  a  tool  that  will  help  controllers  to  ensure  separation  and  will  alert 
controllers  to  a  potential  loss  in  separation. 

The  results  of  this  study  support  three  of  the  four  above  recommendations.  While  nothing  in  the 
present  data  suggests  the  need  for  electronic  flight  strips,  the  data  do  support  exploring  the 
benefits  of  ASDE,  AMASS,  and  the  other  tools  mentioned. 
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5.7.1  Revisiting  Controller  Suggestions  (from  Kelly  and  Jacobs,  1998) 

Recall  that  an  extensive  survey  of  1111  controllers  and  managers  at  63  Level  3, 4  and  5  towers 
identified  five  areas  for  consideration  of  tower  improvements: 

•  Stop  lights  on  runways  activated  by  surface  surveillance  systems. 

•  Improvements  to  ASDE-3. 

-  Tag  the  targets  with  the  aircraft  ID. 

-  Reduce  the  number  of  false  targets. 

-  Reduce  the  interference  caused  by  rain. 

•  Relief  from  radio  frequency  congestion  and  the  problems  associated  with  it. 

•  Relief  from  tower  cab  features  that  interfere  with  the  controllers’  scan  of  the  airport 
surface. 

-  Placement  of  displays  on  top  of  the  consoles  obstructs  vision. 

Inadequate  tower  shades  hinder  controllers’  ability  to  see  the  airport  surface. 

•  Improving  the  use  of  “memory  aids.” 

While  the  operational  errors  and  deviations  examined  do  not  contain  information  that  speaks  to 
false  targets  displayed  on  ASDE-3  or  interference  caused  by  rain,  problems  with  radar  was  the 
most  common  equipment  concern  seen  in  the  ASRS  reports  submitted  by  tower  controllers. 
Similarly,  “inadequate  tower  shades”  is  not  identified  as  a  contributing  factor  in  the  operational 
error  data  base,  but  was  identified  in  controller-submitted  ASRS  reports.  New  technologies  that 
could  provide  an  effective  improvement  to  traditional  tower  shades  continue  to  develop  and 
merit  attention.  (See  Appendix  B  for  a  full  discussion  of  this  issue.)  In  general,  the  need  for 
improved  surveillance  and  memory  aids  are  well  supported  both  by  the  pilot  and  controller 
errors  examined  in  this  study  and  by  controller  opinion. 
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6.  CONCLUSIONS 


The  tower  “shortfalls”  that  this  study  points  to  are  the  need  for: 

•  Improved  surveillance  and  monitoring  equipment  that  is  most  appropriate  for  a  specific 
airport  or  part  of  an  airport  (e.g.,  ASDE-X,  AMASS,  runway  status  lights,  loops). 
Included  in  this  is  that  pilots  and/or  controllers  need  a  means  of  determining  whether  an 
aircraft  is  clear  of  the  runway.  Sophisticated  systems,  such  as  AMASS,  require 
significant  investment  for  site  adaptation  and  only  will  be  useful  if  the  warnings  are 
timely  and  false  alarm  rate  is  acceptably  low.  However,  because  of  their  significantly 
lower  price  tag,  less  sophisticated  systems  such  as  loops  and  runway  status  lights  and 
unsophisticated  solutions  such  as  markings  (particularly,  more  conspicuous  indicators  of 
runway  hold  points)  and  lighting  show  potential  for  a  higher  (and  more  certain)  return  on 
investment. 

•  Better  memory  aids  (and  more  consistent  use  of  memory  aids). 

•  Improved  means  of  controller-pilot  communication  to  reduce  frequency  congestion, 
eliminate  stepped-on  and  blocked  transmissions,  and  reduce  the  probability  of  an  aircraft 
accepting  a  clearance  intended  for  another  aircraft. 

•  Improved  means  of  facilitating  coordination  among  controllers  -  this  could  be 
accomplished  by  a  variety  of  means,  such  as  shared  displays,  improved  means  of  voice 
communication,  or  changes  in  procedure. 

In  addition,  the  following  are  recommended: 

•  Revise  the  method  for  the  investigating,  collecting  information,  and  recording 
information  on  controller  operational  errors  and  deviations  so  that  it  is  more  consistent 
and  useful  in  determining  the  causes  and  potential  remedies  to  incidents.  This 
mechanism  should  be  standardized  with  unambiguous  categories  (e.g.,  contributing 
factors).  The  categories  should  be  revised  to  include  the  most  common  types  of 
controller  errors  (such  as  “forgetting”)  and  ambiguous  categories  should  be  eliminated.  It 
should  include  operational  variables  that  would  benefit  from  more  research,  such  as: 
whether  the  supervisor  or  controller-in-charge  was  working  a  position,  whether  positions 
were  combined  (and  if  the  combination  was  normal  for  that  facility  at  the  time),  LAHSO, 
and  intersection  takeoffs. 

•  Survey  towers  for  “homemade”  memory  aids,  runway  incursion  prevention  mechanisms, 
and  other  unique  facility  inventions  (such  as  a  bar  code  mechanism  to  record  delay  times) 
so  that  the  effects  of  these  aids  can  be  studied  and  the  information  can  be  disseminated  to 
all  towers. 

•  Provide  support  to  towers  to  expedite  the  acquisition  of  needed  equipment  or  other 
resources. 
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•  Encourage  individual  towers  to  perform  their  own  “risk  analysis”  identifying  significant 
factors  in  their  own  incidents  (e.g.,  the  intersections  or  other  locations  on  the  airport 
surface  where  the  incidents  are  likely  to  occur,  and  the  type  of  aircraft  operators  involved 
[helicopter,  GA,  military]),  identify  what  can  be  done  (markings,  procedures,  pilot 
education,  etc.)  to  prevent  future  occurrences,  and  provide  the  resources  to  assist  towers 
in  these  analyses  and  remedies.  Develop  a  protocol  for  this  analysis  that  will  assist 
facility  specialists  in  identifying  potentially  troublesome  operational  situations  at  their 
facility,  such  as  particular  intersections  or  specific  combinations  of  positions. 

•  Investigate  more  conspicuous  means  of  indicating  runway  hold  locations. 
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APPENDIX  A  -  DEFINITIONS 


Definitions  of  Factors  Contributing  to  Operational  Errors  and  Deviations  as  Listed  in  the 
Operational  Errors  and  Deviations  System  (OEDS)  Data  Base. 

Aircraft  Observation:  Indicates  whether  the  control  tower  observed  any  contributing  factors 
related  to  aircraft. 

Communication  Error.  Indicates  whether  any  contributing  factors  were  related  to  a 
communications  error. 

Complex  Runway  Configuration:  Indicates  that  runway  configuration  was  associated  with 
traffic  complexity. 

Complexity-Number  of  Aircraft:  Indicates  that  the  number  of  aircraft  was  associated  with 
traffic  complexity. 

Coordination:  Indicates  whether  any  contributing  factors  were  related  to  coordination. 

Ground  Operations:  Indicates  whether  any  contributing  factors  were  related  to  ground 
operation. 

Inappropriate  Use  of  Visual  Data:  Description  of  other  inappropriate  use  of  visual  data 
contributing  factors.  Examples:  failed  to  observe/remember  vehicle  on  runway;  controller 
misjudged  separation 

Inappropriate  Use  of  Displayed  Data:  Indicates  whether  the  contributing  factors  were  related 
to  inappropriate  use  of  displayed  data. 

Operational  Error:  An  occurrence  attributable  to  an  element  of  the  air  traffic  control  system 
that  results  in  less  than  the  applicable  separation  minimum  between  two  or  more  aircraft,  or 
between  an  aircraft  and  terrain  or  obstacles  and  obstructions  as  required  by  Handbook  7110.65 
and  supplemental  instructions.  Obstacles  include  vehicles,  equipment,  and  personnel  on 
runways. 

Runway  Incursion.  Any  occurrence  at  an  airport  that  involves  an  aircraft,  vehicle,  person,  or 
object  on  the  ground  that  creates  a  collision  hazard  or  results  in  loss  of  separation  with  an  aircraft 
taking  off,  intending  to  take  off,  or  intending  to  land. 

Visual  Data:  Indicates  whether  any  contributing  factors  were  related  to  improper  use  of  visual 
data. 
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APPENDIX  B  -  PROMISING  TECHNOLOGIES  FOR  THE  CONTROL  OF 
SUNLIGHT  IN  AIR  TRAFFIC  CONTROL  TOWERS 


Daniel  J.  Hannon,  Ph.D. 

Uncontrolled  sunlight  is  one  of  the  biggest  obstacles  to  the  use  of  full-color,  commercial-off-the- 
shelf  (COTS)  electronic  displays  in  air  traffic  control  (ATC)  towers.  Although  full  color 
displays  are  readily  available,  they  suffer  from  image  washout  when  exposed  to  sunlight. 
Currently,  the  FAA  is  developing  new  ATC  systems  that  rely  on  the  display  of  colored 
symbology.  These  systems,  however,  also  rely  on  the  use  of  COTS  displays  for  displaying 
information  to  the  controllers.  Traditionally,  high  brightness  monitors  that  have  been 
specifically  designed  for  high  brightness  environments  have  been  employed  in  the  ATC  tower. 
Unfortunately,  technical  restrictions  limit  these  displays  to  a  monochromatic  (i.e.,  single-color) 
output.  Antiglare  coatings  can  provide  some  improvement  to  the  performance  of  full-color 
display  screens,  but  this  is  often  at  the  expense  of  total  light  output,  making  displays  appear 
darker.  In  order  for  the  systems  with  color  displays  to  be  fully  utilized  in  the  tower  environment, 
therefore,  adequate  control  of  ambient  sunlight  is  required. 

ATC  towers  have  used  strategic  placement  of  the  displays  and  mechanical,  pull-down  window 
shades  to  mitigate  the  effects  of  sunlight  on  display  washout.  Display  screens  can  be  oriented  to 
minimize  their  exposure  to  direct  sunlight.  The  possible  location  of  the  displays,  however,  is 
limited  by  the  need  for  the  controllers  to  be  able  to  both  see  the  displays  and  see  out  of  the 
windows.  The  window  shades  are  transparent,  neutral  density,  filters  (similar  to  sunglasses)  that 
block  some  of  the  light.  Mechanical  failures  in  the  retraction  mechanisms  and  gaps  in  the 
between  the  shade  and  the  window,  however,  often  reduce  the  effectiveness  of  the  shades.  At 
times,  controllers  in  the  tower  must  resort  to  wearing  sunglasses  to  control  the  amount  of 
sunlight  to  which  they  are  exposed.  The  wearing  of  sunglasses,  however,  can  make  colors  harder 
to  see  and  may  make  it  impossible  to  see  some  colored  symbols.  Furthermore,  these  effects  will 
be  as  variable  as  the  types  of  sunglasses  worn.  That  is,  while  some  sunglasses  can  make  certain 
colors  harder  to  see,  other  sunglasses  -  with  different  optical  characteristics  -  will  have  a 
different  effect  on  color  perception.  This  means  that  it  is  impossible  to  predict  which  colors  on  a 
display  will  be  effected  without  knowing  the  optical  properties  of  the  sunglasses. 

Improvements  to  the  mechanism  for  shading  the  windows  that  eliminates  the  mechanical  failures 
of  the  shades  and  eliminates  the  gaps  between  the  shades  and  the  frame  of  the  window  will 
provide  the  greatest  potential  benefit  for  the  future  use  of  color  displays  in  the  ATC  tower. 

There  are  two  ways  of  approaching  this  problem.  One  is  through  the  development  and/or 
application  of  an  alternative  window  shading  technology.  The  second  is  through  the  use  of 
‘smart  windows’  that  incorporate  a  dynamic  filter  into  the  glass  that  adjusts  the  light 
transmission  through  the  glass  in  response  to  an  electric  input. 

Federal  Aviation  Administration  (FAA)  specification  E-2470b/ 1250-5  determines  the  design  of 
the  window  shades  currently  used  in  ATC  towers.  This  includes  the  material  of  the  shade,  the 
retraction  mechanism,  the  mounting  brackets,  the  method  of  mounting,  etc.  According  to  a 
representative  from  the  Solar  Screen  Company,  a  supplier  of  ATC  window  shades,  any  change  to 
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the  design  and  function  of  the  shades  would  require  a  new  specification.  However,  some  control 
towers  have  used  supplemental  strips  of  shade  material  and  attached  them  to  the  edges  of  the 
windows  to  eliminate  the  problem  of  the  gaps.  These  strips  are  narrow,  but  permanently 
attached.  The  drawback  to  this  approach  is  that  when  the  shades  are  not  in  use  there  is  a 
permanent  shade  around  the  edge  of  the  window.  Additionally,  the  presence  of  this  window 
edge  shading  is  probably  not  detectable  at  night,  but  would  most  likely  diminish,  if  not 
completely  obscure,  vision  around  the  edge  of  the  window.  Controllers  would  not  be  able  to  tell 
if  there  was  simply  nothing  outside  or  if  the  light  from  an  object  was  just  too  dim  to  detect 
through  the  shaded  edge  of  the  window. 

An  alternative  technique  to  the  permanent  application  of  strips  of  window  shade  material  is  the 
use  of  removable  window  shade  material  that  sticks  directly  to  the  window.  This  type  of 
window  shading  is  most  commonly  seen  in  automobiles.  A  plastic  sheet  is  stuck  to  the  window 
and  peeled  off  when  not  needed.  Strips  of  this  material  could  possibly  be  constructed  for  ATC 
tower  windows  to  shade  the  edges  of  the  windows  when  needed  and  removed  as  the  sunlight 
changes  throughout  the  day. 

A  completely  different  approach  to  the  problem  is  the  use  of  ‘smart  windows’.  Although  there 
are  three  different  technologies  that  have  been  lumped  under  this  term,  the  only  one  that  has 
potential  for  ATC  application  is  called  “electrochromic”  windows.  Electrochromic  materials  are 
transparent  chemicals  that  change  their  transmittance  with  an  applied  electrical  current.  Thin 
films  of  electrochromic  materials  can  be  applied  to  a  sheet  of  glass  and  banded  by  an  electrode. 
After  applying  an  electric  potential  to  the  electrodes,  the  transmittance  of  the  window  can  be 
modulated  in  accordance  with  the  applied  voltage. 

The  advantage  of  this  technology  over  the  use  of  window  shades  is  that  it  completely  eliminates 
both  of  the  problems  with  window  shades  noted  above.  Electrochromic  materials  fit  the  entire 
window  so  gaps  in  the  shades  are  eliminated.  Also,  there  are  no  moving  parts  so  the  mechanism 
problem  is  removed  as  well.  Electrochromic  windows  are  transparent  in  their  off  state  so  that 
failure  of  the  circuit  would  result  in  a  perfectly  useable  window.  These  devices  have  been  tested 
under  a  variety  of  environmental  conditions  and  shown  to  be  rugged,  with  warranties  expected 
for  a  minimum  of  10  years  or  more.  A  photocell  that  is  connected  to  the  electrical  circuit  could 
continually  adjust  the  transmittance  of  the  window  throughout  the  day  from  dark  during  the  day 
to  clear  at  night. 

Electrochromic  windows  are  still  primarily  in  the  development  stage  with  only  a  small  number  of 
manufacturers  around  the  world.  In  the  United  States,  the  US  Departments  of  Energy,  Defense 
and  Commerce  are  supporting  programs  for  the  development  of  this  technology.  Presently,  the 
largest  panels  available  are  on  the  order  of  3’  x  2’.  Most  development  efforts  are  currently 
focusing  on  scaling  this  technology  to  larger  sizes. 

The  present  application  of  electrochromic  windows  to  the  ATC  tower  would  require  human 
factors  evaluation  of  certain  aspects  of  the  windows  that  are  not  yet  known.  First,  the  small  size 
of  the  panels  relative  to  the  current  size  of  ATC  windows  would  require  that  the  panels  be  tiled 
on  the  windows.  Every  panel  would  require  a  surrounding  electrode  creating  additional  opaque 
areas  in  the  windows  resembling  the  frames  around  windowpanes.  Second,  although 
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electrochromic  panels  are  designed  to  be  spectrally  neutral,  there  is  a  tendency  to  block  more 
long  wave  light  with  increasing  voltage,  giving  the  shades  a  slightly  bluish  appearance.  This  is 
most  likely  a  desirable  property,  but  could  effect  chromatic  adaptation  and  the  perception  of 
color  on  displays.  Third,  the  response  time  of  electrochromic  materials  is  not  close  to 
instantaneous,  but  is  on  the  order  of  seconds  or  at  worst  minutes.  While  this  should  make  them 
responsive  enough  to  adjust  to  fluctuations  in  daylight,  an  analysis  would  be  required  to 
determine  whether  this  responsiveness  would  be  sufficient  for  the  tower. 
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